I just wanted to bring to your attention a recent acceptance at CCR of
work done here at my lab, where we have argued using Bro as the best
choice for data plane programmability.
I really think Bro language should be expanded beyond just the definition of
NIDS. It provides a much more powerful construct.
The details about the project (which deals with a novel ISP service delivery mechanism), and a link to the paper are the project website (http://sysnet.org.pk/w/ISDF).
This page also has links to the ports we have done (and previous posted on this list by the students -- who did the real work :).