Packetfence - GPL Worm Defense Tool

Packetfence is the name of a new worm defense tool designed for LAN security. Based on the overview, Packetfence looks like it can work in either of two ways. The "Layer 2" approach uses ARP poisoning to stop worm infected hosts from spreading any further. Using it as an inline bridge in the "Layer 3" mode you can basically use it like you would use the Snort plugin Snort-inline (now a part of the main Snort branch). From their website:

PacketFence provides interior worm mitigation and policy enforcement capabilities. PacketFence be placed strategically throughout the enterprise to compartmentalize networks that may present a threat to valuable resources: VPN concentrators, client and guest networks, extranet connectivity points, etc. PacketFence is designed to operate in heterogeneous where users are either unable or unwilling, without assistance, to secure their systems properly.

Looking at the pieces that you assemble (which are all open source), it looks like you have to keep your Snort installation updated to detect worm hosts, so reacting to new worms will always be slowed down a bit due to the time it takes to generate signatures. Secondly, by using ARP poisoning you effectively shut off all communications from those hosts, which can be an undesirable situation. Also, some low-cost switches don't react well to ARP poisoning, so you can cause more damage than good if you're not careful.