Best way to alert portscan activity?

[Rich <iso_list () yahoo com>]

Anyone have any creative suggestions about how to
alert when portscanned?
We have users who would like to know every time they
are portscanned.
They want to know what the source IP they scanned from
was and what local machines were scanned.

We are using demarc puresecure as the front end and
there is no ability to email when portscanned. 

Thanks for any suggestions you may have. 

__________________________________
Do you Yahoo!?
Yahoo! Mail - More reliable, more storage, less spam
http://mail.yahoo.com


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users