Unfortunately my spare-time for topics like these was a little limited recently. Regarding your questions the slirp-code inside qemu is
concentrated in a directory called slirp. So the idea is to simply take
this code build something like the main-loop of qemu add some
glue-code to make references happy and instead of communicating
with virtual ethernet-interfaces of virtual machines make it use
pcap instead. Under http://article.gmane.org/gmane.comp....ors.qemu/39831 you
can find a patch which brings pcap-support to qemu (not in the
official qemu because of some drawbacks which don't hurt us
here). So all code is basically there what is missing is to remove
the actual qemu and add some glue, command-line handling and
so on...