Snort Sensor Placement Outside Firewall

["Rich Lichvar" <rlichvar () knowledgeresourcecenter com>]

I know this is a bit off-topic, but I need some advice/help and would like
to tap the experience of those who probably have successfully done what we
are thinking of doing.

We are thinking of putting a Snort-based sensor outside our firewall in the
Untrusted zone. (This is after the border/edge/gateway router which is
controlled by our hosting facility and not us.) I was wondering if any of
you had any advice about:

1. OS: Linux? Hardened how? What system capacity (RAM, hard drive) might be
required?
2. Cabling setup: Internet Cat 5 cable to hub and cable from hub to sensor
and cable from hub to Untrusted port of firewall? (I've tried this in the
past and had problems with traffic even getting to the firewall. Maybe a
crossover cable is needed?)

Many thanks in advance for any advice/experience you would offer.

Richard L. Lichvar
Director, Operations
Knowledge Resource Center, Inc.
Phone: 703-848-2100 x228
Fax: 703-848-4747
Mobile: 571-221-3430