DoSDetector analyzes and detects suspicious IP traffic and alerts about it.
It can detect worm traffic, SYN flood, ICMP flood, UDP flood attacks and more.

It's configurable via a rule set; when an IP exceeds the score limit,
DoSDetector prints a warning.

WWW: http://dark-zone.eu/resources/unix/dosdetector/