snort, where to listen?

[debian@raycone.net]

Hi all,

I just installed Snort IDS on my firewall Debian box which is so configured:

eth0 10.0.0.1 (serves internal LAN)
eth1 192.168.100.1 (directly connected to an ADSL modem auto-connecting to the 
provider with IP 192.168.100.2)

I run snort on eth1 NOT in promiscuos mode and I send periodic email reports to me.

The problem is that I receive messages from the kernel (firewall) indicating some 
"action" blocked from the internet, but snort never shows up anything in its reports.

Could someone tell me if I misconfigured the system and, please, a possible right 
configuration ?

Thans in advance

Alex