Network based intrusion detection

[Greg]

I was wondering what everyone is doing for network 
based intrusion detection?  I am looking for 
something I can use on a University based system 
with approximately 15000 nodes with various flavors 
of Unix, Linux, Windows, Mac, etc.  I do have access 
to the logs of all incoming traffic (Cisco netflow).  
Does anyone have any scripts they use to analyze 
the logs, ar know of any products that will do 
this?

Thanks in advance for any help.

Greg