Suricata

Also written: suricata

A free NIDS and NIPS. It runs passively on an interface (-i) to alert, or inline on NFQUEUE (-q 0) to drop.