tc (traffic control) is often not-mentioned but super powerful. It's lower-level/upstream from iptables and barely takes any overhead. Mirroring, port knocking, advanced byte dropping, etc are all possible. Documentation/examples a bit lacking, unfortunately.