You want to insert a tap between two particular points on your network.
Construct a passive tap.
A passive tap is slightly more complex than the receive-only Ethernet cable. You require a four-port Ethernet housing, four category 5e modular snap-in jacks, and bit of category 5e cabling.
You can see an example in Figure 1-11.
Figure 1-11. Passive tap example
Cut off any excess wire and seal up the Ethernet housing. Port 1 should be connected to the source at one side, and port 4 should be connected to the destination on the other side. Ports 2 and 3 will dump the traffic in each direction, respectively.
Snort online documentation, "IDS Deployment Guides" (http://www.snort.org/docs/)
Invisibly Sniffing 100 MB Ethernet
Installing Snort from Source on Unix
Logging to a File Quickly
How to Build Rules
Detecting Stateless Attacks and Stream Reassembly
Managing Snort Sensors
Generating Statistical Output from Snort Logs
Monitoring Network Performance