Christiaens Joachim wrote:
> Would a simple tap-'device' work in this situation?
> Where you just connect the RX pair of a nic in your IDS box parrallel to
> your RX pair on the m0n0, and this for each interface? Don't know about
> impedance etc, but this should be possible someway (optocouplers?), and safe
> to 'go around' the firewall this way, since the interfaces cannot be used to
> transmit anything...

If you're only interested in half of the conversation.

A typical tap has four ports.  One for each node and two for the 
IDS/sniffer.

http://www.netoptics.com/