recommendation for monitoring traffic

[John Friedman <jfriedmanx () yahoo com>]

Hi all,
 
Curently, I span the firewall  port  on teh core switch to the snort monitoring port only  for Rx traffic.  The snort 
is placed inside firewall.I manage it through the second NIC on the Snort box.   Should I monitor both TX/Rx traffic?  
 
If I want to exclude one server from the monitoring segment, what's the syntax?
 
Thanks in advance,
 
John
 
 
 
BTW, I tried to exclude on server from this motoring segment 

                
---------------------------------
 Yahoo! FareChase - Search multiple travel sites in one click.