MT Router and Suricata as a IDS

RouterOS General
1

Hi,
im planing a lab scenario to try Suricata IDS.
network enviroment is MT CRS125-24G switch and RB4100iGS+ router, one hyper-v host with VM-s., 100Mbit fibre for WAN.
network addressspace: 10.1.1.0/24 LAN , Gateway 10.1.1.254 - eth2 on RB4011
My idea is to port mirror eth2 to eth8, give address 10.1.2.10 and plug VM with Suricata installed into eth8 so it can listen to traffic.
It will be availabe from 10.1.1.0/24 because of directly connected devices.

Or should i make port mirroring on switch?
All suggestions and corrections are welcomed!

2

Have you read this?
http://forum.mikrotik.com/t/suricata-ids-ips-integration-with-mikrotik-now-with-ossec/101160/1

3

Thx karlisi,
I will try with streaming_enabled.