Quote:

Bryce,

Thanks for your reply. Kix is not an option It has to be something like Mcafee Entercept, Symantec Host IDS, ISS Proventia, etc.





Yeah i know, just wanted to toss it out there as a "cool! hey look at this" statement.

Question is, where do you want to watch for intrusion at? the internet gateway? the servers? users desktop....

for server level check out snort.

The gateway lvl, will depend on what you have for a gateway. If, you can do syslogging on your gateway, then you could maby do something with that, and a software product that watches the syslog. Kiwi (http://www.kiwisyslog.com/) is a great syslog server for win32 systems.

at the pc level.....this level might be more trouble than it is worth..