Michael W. Lucas has a review up of Richard Bejtlich’s “The Practice of Network Security Monitoring“.  Both of them are long-term BSD users, and Bejtlich, if I remember correctly, was part of the design of Capsicum, the security framework that is serving as a Summer of Code project for DragonFly right now.  So it’s worth looking at his book.  And/or looking at his blog, for those who want more.