Now that I've got my firewall in place, I've been amused to see some of the traffic that I've been getting. I know that there are a number of tools out there that provide reports based upon iptables output, but I'd appreciate if anyone could give me some recommendations.

From what I gather, some of the tools require a kernel recompile and then use the QUEUE target to write the info to a special log (or something like that) and then have another anlysis piece.

I've seen some others that seem to work off of the /var/log/messages.

My ideal tool would keep /var/log/messages a bit cleaner, deliver some reasonable reports, and be PERL based.

http://drewie.host.sk/iptqlog/

maybe 2 simplistic 4 u'r needs, but worth a try.

I had downloaded this package but haven't compelted installation (I had to rebuild the Kernel to support the Queue target and haven't tried it out yet)...