It can do much more than analyze packets. It's a way of running user defined programs in kernel space with fairly strong assurances that it won't crash the kernel.