Use Perl compatible regular expressions (PCRE) keywords to write rules for OpenSignatures on your Network IPS appliance.
alert tcp any any -> any any (pcre:"/GOO/i";)
alert tcp any any -> any any (pcre:"/GET.*\.htm/i";)
alert tcp any any -> any 80 (msg:"Google image
search";pcre:"/Host\:\simages.google.com\r\n/ism";sid:1000;)
alert tcp any any -> any 80 (msg:"Gator Agent Traffic";content:!"User-Agent\:Akregator";pcre:"/User-Agent\:[^\n]+Gator/i";sid:1000;)
alert tcp any any -> any 80 (msg:"Yahoo Mail Login";content:"yahoo";pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mail.yahoo.com\r\n) /ism";sid:1000;)