The README that Hobbit (author of the original netcat) wrote is a really good read. I learned a lot when I first read it years and years ago.
I especially remember it describing how it is possible to get "in front" of another daemon.
If the daemon has bound a listening socket to 0.0.0.0, as most do, you can bind to a more specific address on the same port and intercept inbound connections. Fun!
http://sysunconfig.net/unixtips/netcat_readme.html