snort question

[justin cunningham]

Hi, I haven't used snort before and wanted to see where the incoming
traffic to my external ip is coming from.  Can I do this with a machine
behind the router?  I mean, the deb machine is sitting on a 192x and I
want to see the incoming traffic on the external ip.  Is this possible
or do I have to have the box before the router or should I just stick
with tcpdump?  Thanks for any suggestions, justin