Feature

Small source distribution
Portable (*BSD, Linux, Solaris, IRIX, HP-UX and Windows)
Fast (High probability of detection for a given attack on 100+Mbps networks)
Configurable (Easy rules language, many reporting/logging options)
GPL