NFR by Network Flight Recorder

NFR is available in multiple forms: a freeware/research version, the "NFR Intrusion Detection Appliance" which comes as bootable CD-ROM and bundles from 3rd party resellers that add their own features on top of it (like Anzen).

One of the popular features of NFR is "N-code", a fully featured programming language optimized for intrusion detection style capabilities. They have a full SMTP parser written in the N-code. Most other systems have either simply add signatures or force you to use raw C programming. Numerous N-code scripts are downloadable from the Internet from sources such as Lopht.

NFR does more statistical analysis than other systems. The N-code system allows easy additions into this generic statistical machine.