I have SNORT configured to listen on the monitor port of CISCO switch, which is also directly connected to the internet provider.

The problem I have is that when I´m using BASE to check for the events all my source addresses are the same for the outgoing connections, basically the static IP address my provider gives me.

The same happens for incoming traffic, but there the destination address is always the same.

How can I configure SNORT to put internal-LAN IP addresses to the log instead of the gateway one ?

thanks