Network Traffic Threat Analyzer?

I've been using Xymon for years to monitor system health, but I've never found a cost efficient Network Traffic Threat Analyzer that watches for suspicious traffic.  Firewalls are great but I'm looking for something that watches the actual traffic and can notify me if there's something suspicious that needs reviewed.  Does anyone have any low cost suggestions?  I've looked at a system called Alienvault but it's pretty spendy.