I've written a howto on combining Suricata and RouterOs (/tool sniffer) for a SOHO setup as IDS (Intrusion detection system). I link it here, as I've read multiple times people asking for it and today I got some time to write everything down. So here is it:

http://robert.penz.name/849/howto-setup ... ta-as-ids/

Why not post this on the Wiki? People search the MikroTik Wiki also.

Because I post in my blog not only Mikrotik stuff (in reality it is only a small part) and I want one central place for all my stuff.

Understood, would be nice to post to the MikroTik Wiki also though and help to contribute. Just a thought.