@bea then cisco's snort box... they're all snake oil, but at least that one tries not to be.
Iran that research team for a number of years and read all the rules for all the IDS/IPS products for years, the others are all regexp trash that is hidden behind crypto