LSM (Loadable Security Module) is a very simple but effective intrusion prevention loadable kernel module. Current functionality involves protecting extended file attributes on ext2 from being modified by the super user and the module from being removed and other modules from being loaded. The basic protection also prevents access to raw devices, so debugfs can not be used on a disk partition nor can a change to the boot process occur. You will not be able to reconfigure lilo, if the module gets activated.
Maudio is a simple audio mirroring device (a sort of audio pipe). Unlike a filesystem pipe, maudio behaves as a hardware soundcard. In particular, after installation of the driver, you get two audio-like devices (usually /dev/dsp0 and /dev/dsp1) which are connected to each other. Everything sent to the first DSP will appear as sound data on the second DSP and vice versa.
Smit is an ARP-level transproxy/sniffer, capable of relaying local traffic even in switched environment. The source is based on the arprelay and arpmitm tools, but offers a nice command line interface and option of saving raw packets into a file. It includes some tricky techniques for ARP-cache consistence. You can also run Smit in transproxy-only mode and use your favourite sniffer to capture 'hijacked' packets, and it includes a ring buffer option for high performance packet capture.