There used to be this software that existed maybe 8-10 years ago (I thought it was maybe called FloodGate?) It worked by having a Linux box bridge running snort or prelude. When it detected a DOS or DDOS attack (and presumably others), it would actually connect to your Cisco routers and block the source IP at the router.
Has anyone heard of this software or know where I can get it?