Along these lines I use spong (spong.sourceforge.net) to do network monitoring and some security things. It has a tripwire-like "plugin" that uses some of the crypto modules to watch for incursions.

Nice, fairly featureful tool with plenty of expandability and a robust usage history.