Snort is a rule based IDS/IPS and BroIDS is a policy based IDS. In their default configurations rule based IDS reacts (alerts, blocks) based on the rules loaded

Snort is a rule based IDS/IPS and BroIDS is a policy based IDS. In their default configurations rule based IDS reacts (alerts, blocks) based on the rules loaded where policy based systems like BroIDS interpret the traffic they see and can react to kinds of traffic if configured. In practice Snort (Suricata, etc) can read, understand and react to individual streams on the wire very quickly. This is especially important for intrusion prevention (IPS) inline. BroIDS (prelude, etc) generate detailed logs and highlight interesting traffic (as configured) and are excellent for gathering intelligence. One of the recently popular features of BroIDS is to decode and save to disk all files in traffic it sees, checking the hashes of those files against blacklists as it goes. If you are at all interested in these systems you should try out Security Onion at www.securityonion.net, an awesome pre-configured Linux with many network security monitoring (NSM) tools already installed including Snort, BroIDs and many many others.