What interface do you monitor? If it is Ethernet only, Ethereal is a good choice. If it is ATM, Serial etc, I would recommend to consider Niksun NetVCR (www.niksun.com). It is a commercail appliance building on FreeBSD kernel. It captures raw packets and stores into database for post-event analysis w/ stream reassembly regardless of the L2 protocol.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...