In practice, is Snort run *on* an Internet-facing Web server or does one run Snort on a dual-homed machine *in front of* a Web server? Can anyone hold court on the subject? Jeff