performance of intercepting packets

Something was unclear in the docs & tutorials I read about fwknop...

Does it need to intercept and inspect all packets? or just packets on a specific port?

What's the performance hit of doing so?