You mean like this: http://www.snort.org/docs/tap/?
--rick

Christiaens Joachim wrote:
> Would a simple tap-'device' work in this situation?
> Where you just connect the RX pair of a nic in your IDS box parrallel to
> your RX pair on the m0n0, and this for each interface? Don't know about
> impedance etc, but this should be possible someway (optocouplers?), and safe
> to 'go around' the firewall this way, since the interfaces cannot be used to
> transmit anything...
> 
> just so thoughts...
> 
> Joachim