Network Based Application Recognition (NBAR) on Cisco Routers will be the best choice for you.
It can clock different high layer service depending your definition in the config.
PIX does not support NBAR, so only can use CBAC or traditional access-list to block ip address and TCP, UDP ports.
