As cheyenne1212 suggests, I would install snort on a host _on_, in front of, or inline with your gateway to
the internet; this is where an IDS is going to be most effective as an early-warning tool....