LIDS IDS functionaity Built in port scan detector No raw sockets needed Logging of capability denial attempts Built in log-via-email abilitiy Do you really want SMTP in the kernel?!?!?!?