Thanks a bunch, mdillon - PortSentry is even Debianized!

Looks like logcheck may give me some trouble as a seriously unstable Debian package, but Potato is expected soon.

Update: perusing the PortSentry info, looks like it runs a server of sorts that listens on every port you wish to monitor. mdillon was soooo right - I don't want to write it myself. grin