Depends on what you want.
If you want a logfile lighting up like a Xmas tree w/o caring for what's up, go for Portsentry, scandetd etc etc.
If you want details on what's travelling tru the wire for real (buffer overflows, faked logins, worm scans, etc etc), and just don't care for scan-happy skiddies, go for Snort.
|