The other side of Intrusion detection on Linux: Snort

[Fred]

You may wonder why the title contains the words " the other side". In our Tripwire article we've shown that there are two major types of Intrusion Detection Systems: network-based and host-based. While Tripwire is host-based, this time we will show you how to install and configure Snort, a network-based IDS/IPS. We will not repeat the theoretical introduction, because we already exposed it in the previous article. We'll go directly to installing and configuring snort for your needs. What we expect from you in terms of knowledge is thorough understanding of networks, security and system administration.

More... (http://how-to.linuxcareer.com/the-other-side-of-intrusion-detection-on-linux-snort)