Have you read TheHorse13' tuts on Nmap? That's where I'm starting from. Don't know much yet myself, though I do know the above mentioned SNORT is quite popular.