attack packet clasification for forensic purpose that integrates firewall and ids functions

I need to collect packet for forensic purpose. The packet form network will be collected by a sniffer and will be classify according to related attack ie dos, r2l, l2r, probe using inference engine that apply fuzzy logic. Finally the record will be stored in a database. Simple algorithm for 3 process will do ie: 1 packet collection, packet classification, packet storing.