Two Snorts

Here's
a May Unix Review article which
discusses the value of running two instances of Snort: one tuned to
protect your service(s), the other with most, if not all, rules turned
on to see what's "floating around" on the Internet.