interesting stuff is coming for Snort: New data acquisition modules
(you'll be ablt to take the packets rejected by your IPFW/IPTables/etc.
and feed them into Snort for analysis). New stream reassembly modules.
IPv6. New defrag modules.
Based on the presentation and depending on
how it's implemented, Snort could get very complicated for production