Writing custom Snort rules and what to check if they are correct? ..up to a certain point.
Well dumbpig  by Leon Ward is what you are after. For a good example check out VRT Sourcefire’s blog entry .
…while you are at it have a look at Snoge  “Take your Snort or Sourcefire IPS events and place them onto Google Earth.”.
 – dumbpig – http://leonward.wordpress.com/dumbpig/
 – Syntax Checking your Snort Rules – http://vrt-sourcefire.blogspot.com/2009/08/syntax-checking-your-snort-rules.html
 – snoge – http://code.google.com/p/snoge/