http://www.antionline.com/showthread...hreadid=242664
I wrote a tutorial on Network Based Intrusion Detection Solutions. It goes into quite a bit of detail, you might be able to take advantage of it.