which place would be best to place a snort box:

1) internet router --> firewall --> eth0, snort box eth1 --> network switch -->LAN

or

2) internet router --> firewall --> network switch --> LAN with snort box

In setup one, would I also see scans from inside the LAN? Any advice / suggestions ? What would be the pros or cons from either config.

thanks
manuel

If I were you... it sounds like you have a Router and Two computers to me....

I would set up snort on eth0
you then have eth1 which the other computer connects to, correct?

If you have it set up like this....

Modem -> Router -> firewall {eth0 -> eth1} -> eth0?

{} = computer #1

I'm assuming your using twisted cable or a switch between computer one and two.....

You know your Router can act as your firewall right?
It's good to configure iptables on your first computer too if you want the extra assurance.....

Anyways, Like I have it above, Snort will view all traffic coming from computer 1 and computer 2 as well as all incomming traffic to both computers....

also snort will see any traffic, including the traffic that iptables denies.... cause it hits snort before it hits your iptables firewall.....

Hope this helps some....