I want to use different kind of intrusion detection tools like OpenSource Tripwire. Please suggest me some tools which can provide me some additional information to that provided by tripwire? Secondly, how can I get IP addresses of all the clients of my server? Thirdly, Can I merge logs created by all such tools?
First a generality: timestamps are crucial. Use NTP to sync your system's clock, make sure that the clock is not wobbling all over the place. After that, you can move on to the basics.
CERT at Carnegie Mellon has a vastly updated p0f v2.x fingerprint file.
You can run p0f v2.x in the background with an invocation something like this:
p0f -f $FPRINTS -d -t -l -o $LOGFILE
$FPRINTS names the fingerprints file and
$LOGFILE names the file in which output ends up.
p0f will give you a pretty decent guess about what operating system your attacker uses. You will have to co-ordinate p0f guesses with any other data you collect.
An alternative: SinFP3. I found it a little tricky to install, as it had some non-standard Perl module dependencies.