One of the most important phases of the IDS/IPS design identifies the set of features that the system will use. This decision may influence both the performance of the system, and the types of attacks that it will detect. We present a feature classification schema for network intrusion detection, along with the implementation design, intended to provide a better understanding regarding the features that can be extracted from network packets. Our preliminary results show that the proposed schema has the potential to map each of the proposed feature groups into specific types of attacks.