http://www.snort.org/docs/
http://www.linuxsecurity.com/article...icle-6514.html
http://www.linuxsecurity.com/article...icle-6848.html

-w0rm3y