tcpdump is a good one. Ethereal is another good one.

Have you considered a NIDS like snort?