Agreed, snort with base.

EDIT: 1000th post :D

I think it's universally agreed for free snort is best :)

At our work we use Tofino Argon 20 , Also using the new OpenSec V2.0.0 BIND Service Due to its extra protection it gives on Buffer Overflow Detection , SNORT no doubt , Whats really good is disabling all services and only allowing

Ports

80
+ BIND port
+ Disable the Mail service port and re-route your MX records to such as Googles Mail Server

+ Adding a Honeypot trap on all common ports is the best thing to do :)


Here is a sample of one of my honeypot logs

http://www.2shared.com/file/M9MxL2bP/honeypot.html


NOTE: I wanted my lame skids to realize it was a Honeypot

Ull know what i mean when u read the logs