krondo.com
Book: Intrusion Detection
I think this was OK, I don’t remember it very well.