we actually had a thread in another forum going about this, but check out http://project.honeynet.org