I really don't know, but the first thing that occurred to me was implementing a "bump in the wire" type firewall. IE, one that sits on the network transparently and can filter and log traffic without affecting layer 2 or 3 headers.

I have no idea if this is an effective and performant approach, but it sounds feasible. Same with implementing switching or routing functionality.