Have a look at www.demarc.org . Used with snort it really helps.

cheers