I have been using FlowMatrix. What do others do on the cheap?
OSSIM has an Anomalies tab that uses Ntop and can be configured with similar data.
When I did this stuff in the past, I used Ourmon.
WireShark is a free tool you can use to monitor network traffic. Excellent tool to see if a hidden keylogger is trying to email and /or FTP logs because it usually has the address and password in the wireshark log.
I just saw a talk at Shmoocon about the YaF and SiLK tools that looked really good. YaF is a flow collector (which can collect other interesting data as well), and SiLK is an analysis package for them. There's even a nice GUI called iSiLK.