The answers you receive to this question, are going to be very subjective. And, since you've left many gaps in the details, the question is that much hard to answer with any sense of giving you an applicable solution.
You need to look at these sites, and decide where are the good guys, and the bad. Is everyone behind the Pix trusted? Are you concerned about the traffic from the disaster recovery site to the primary site? Is there any outside traffic, i.e., Internet access?
If you have a single point of entry, (the Pix) and you want to monitor traffic coming from outside the Pix in, then IMHO, I would place the sniffing interface, inside the Pix. If you place the sniffing interface outside the Pix, you will be logging/monitoring lots of traffic, that you probably won't care about, since hopefully, the Pix will block this.
If you place the sniffing interface behind the Pix, then the sniffing interface is only looking at filtered traffic, which will be easier to manage. Also, in this configuration, you can use the Pix to shun certain traffic.
Additionally, if you get a 4215 with the quad card, this will give you more options on where to monitor traffic.
Again, this is really a tough question to answer, because we don't know your complete topology.
Take a look at this SAFE Blueprint, that I pasted below, it might be of some help.
http://www.cisco.com/en/US/partner/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a00801bc111.shtml
Also, you might want to pose your question on one of the IDS forums. Try the forum on 'www.securityfocus.com'. Your question isn't really specific to Cisco IDS deployment, and there is a large, experienced audience that participates in the above mentioned forum.
thanks,
chris
