I am an IDS analyst and in my research studies I have come away with one inescapable conclusion. You must know how to pull off all the attempted hacks you see to be able to
properly recognize them, and obviously stop them.
Just looking at tcpdump/ethereal/... logs isn't enough you "must" know what to look for and
be able to recognize things. I would be interested to hear your thoughts.