you can really have some fun with multiple Snort sensors scattered throughout a LAN/WAN all connecting back to a central collection database
Defiantly agree streaker. In my experience, there is a better chance in finding that central collection/management box rather than the sensors. Normally, that is what I look for. On the other hand, I always assume there are IDS's in the network to start with. I don't normally have my suspicions confirmed until I pop a network admin's box and find their network drawings (always very helpful...if not always accurate).