x-forwarded-for an IDS capability

Hi List,

Does anyone know of an IDS vendor/or opensource product that has the
capability of associating
an ip address in an x-forwarded-for http header with an IDS event ?
This includes events that fire on a download as well so there would
need to be some
kind of internal http state management.

I notice this request from Jason Haars back in 2004 to the snort
mailing list but I can't seem to find anything else on this in google
http://archives.neohapsis.com/archives/snort/2004-06/0235.html

thanks

-- 
jac