[andrewstuart2]

Ideally you use a mirror port so that all traffic being routed also gets sent to the SecurityOnion services for automated analysis, reporting, and alerts (depending on how SO is configured).

[awqrre]

Would it be efficient to create iptables rules to mirror traffic on a router that doesn't have a mirroring port?