This question already has an answer here:
- Snort Sensor Placement 2 answers
I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
It depends on what you want to do
Consider what traffic you want to examine, the find the relevant point in your network that the traffic HAS to flow through to get there. Since Snort is a free IDS and hardware is fairly cheap, it may be possible for you to invest in more than one IDS.
I'd also recommend the following read from SANS about configuring and placing IDS's