Port Mirror? IDS

[shooter40sw]

Hi guys, is there a way to port mirror so I can sniff the the WAN traffic or us snort or suricata as IDS, I saw through a search on the web to use the iptables mangle, but it did not work for me, it did not send the packets to the virtual machine IP where I had snort on, I have not adventured with snort on the router because I have a mips router and dont think it can handle it.
Any other suggestion to have an IDS in the local network keeping things simple...
Thanks

 

[ColinTaylor]

This works for me.

iptables -t mangle -A PREROUTING  -j ROUTE --tee --gw 192.168.1.55
iptables -t mangle -A POSTROUTING -j ROUTE --tee --gw 192.168.1.55

Where 192.168.1.55 is a PC running, in my case, Wireshark.

 

[shooter40sw]

This works for me.

iptables -t mangle -A PREROUTING  -j ROUTE --tee --gw 192.168.1.55
iptables -t mangle -A POSTROUTING -j ROUTE --tee --gw 192.168.1.55

Where 192.168.1.55 is a PC running, in my case, Wireshark.

Thanks its working