I have had Snort running for some time now with the switch ports to my web and e-mail server mirrored to the port Snort is connected to. This seems to be working fine but I am now wondering if I should instead mirror the port that the router is connected to instead - I'd still be capturing the traffic to the web and mail servers - my fear is that I may be missing something.

Comments?