www.snort.org ... it can detect allot more than portscans however if that is all you require it is easy to setup and scalable. Also for updated rule sets www.whitehats.com has config files and forums. -- "Never settle with words what you can settle with a flamethrower"