LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions
User Name
Password
Linux - Distributions This forum is for Distribution specific questions.
Red Hat, Slackware, Debian, Novell, LFS, Mandriva, Ubuntu, Fedora - the list goes on and on... Note: An (*) indicates there is no official participation from that distribution here at LQ.

Notices

Reply
 
Search this Thread
Old 08-07-2009, 03:28 PM   #1
a2brute
Member
 
Registered: Feb 2005
Location: State of Denial
Distribution: (X/K)Ubuntu for desktop/laptop, DSL for old machines, Debian for Servers.
Posts: 36

Rep: Reputation: 15
Question EasyIDS help, no TCP traffic on NTOP page, no activity at all on base/snort page


Well, there was no forum for the EasyIDS distribution yet, so I'll ask in the general Distributions forum.

If any one has experience troubleshooting and configuring this distro, any help would be greatly appreciated.

I have installed EasyIDS V0.3, and it went very smoothly. After the install, I logged in to the web GUI and configured the static IP for eth0 and changed the hostname. I also manually set eth1 to run in promiscuous mode, as it was not already configured to do so after the install.

The hardware setup is as follows:
1.8 GHz P4 (northwood)
512 MB DDR RAM
40 GB IDE HDD
Davicom PCI NIC (eth0)
Realtek PCI NIC (eth1)

The box is set up to monitor all traffic coming to and from the router within the LAN. Basically, to catch anything our firewall may not. We have a single 48 port Netgear switch (FS750T2) on which I have configured a "monitor" port which is connected to eth1 on the EasyIDS box, and I have included the port connecting the router in the monitor group.

The issue is that on the NTOP reporting pages there is no sign of any TCP traffic whatsoever. It shows UDP and BOOTP traffic, but no TCP.

Also, on the Base reporting pages, there is no sign of any activity at all, with the top line stating "Sensors/Total: 0/1"

I have tried to check the Snort logs for activity, but quickly discovered the logs must be binary since they only display a short line of garbled ASCII characters. I am also unable to locate logs for NTOP.

If anyone could give me some suggestions on how to troubleshoot this issue further, it would be greatly appreciated. I'm just not sure where else to look for signs of what may be misconfigured.
 
Old 08-07-2009, 06:19 PM   #2
a2brute
Member
 
Registered: Feb 2005
Location: State of Denial
Distribution: (X/K)Ubuntu for desktop/laptop, DSL for old machines, Debian for Servers.
Posts: 36

Original Poster
Rep: Reputation: 15
Update:

Well, in my attempts at further diagnosing what the problem may be, I enabled all the snort rulesets that came with the EasyIDS install. Then when I attempted to restart snort via the GUI, I get a red "[FAILED]" message. I went back and disabled all the rulesets that I had previously enabled, and then attempted to start snort again. Same red FAILED message. I'm pretty stuck now. The fail message that the GUI gives does not give me any indication as to why it failed to start. I'm quite certain the rulesets were all I changed. They are back to their original configuration but is still fails to start. Really not sure where to go from here. I see no option to restore defaults, and since the snort logs seem to be binary I've no idea what errors it might be spitting out that could help me see why its failing to start.

Anyone with a little more experience with this distro or just the snort service, your advice would be greatly appreciated.
 
Old 08-10-2009, 06:31 PM   #3
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Try running it manually (via CLI and in IDS mode) and look for any errors that stdout reports.

Is there anything in your syslog that shows any Snort errors?
 
Old 08-10-2009, 08:33 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,286
Blog Entries: 54

Rep: Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854Reputation: 2854
In addition to what's been said already please note Snort has startup diagnostics, the "-T" switch standing for "test".
 
Old 08-10-2009, 08:44 PM   #5
oakleeman
LQ Newbie
 
Registered: Jul 2008
Posts: 4

Rep: Reputation: 0
David,

The Snort service is likely failing because it doesn't like something in the rulesets. First thing you should do is go to snort.org to get your oinkcode and configure the rules to update. Version 0.3 doesn't support manual rule updates so you'll either have to wait until the rules get updated (set the rule update to e-mail you so you'll know when it ran) or edit the cron job for the snort user (crontab -u snort -e) to change the time when it runs.

After the rules have been updated the login to the console and run snort with the following script: snort -c /etc/snort/snort.conf and it will tell you which ruleset is causing snort to fail. You can then disable that specific ruleset from the web interface or comment out the line in the ruleset file that is causing the error.

I'm leaning towards it being your eth1 nic is why you aren't seeing any TCP traffic. I usually have good luck with Realteks but I have had one or two that wouldn't work.

I responded to your e-mail but since I can only work on EasyIDS on nights/weekends it sometimes takes me a while to answer.

Good Luck.
 
Old 08-13-2009, 01:53 PM   #6
a2brute
Member
 
Registered: Feb 2005
Location: State of Denial
Distribution: (X/K)Ubuntu for desktop/laptop, DSL for old machines, Debian for Servers.
Posts: 36

Original Poster
Rep: Reputation: 15
Thumbs up

OK, I got everything working and here is how...

First, the rulesets. I had to go through rulesets one by one and disable them and then attempt to restart. The Snort service finally restarted ok when I got to the spyware ruleset. So with that disabled, the service runs fine again.

As to my original problem of no Ntop TCP traffic, and no traffic at all being reported by Snort, I am sorry and embarassed to report it came down to a bad network switch. The netgear Smartswitch that was supposed to allow you to configure a monitoring port was malfunctioning and the traffic was not being properly mirrored to the monitor port. I discovered this by just using a basic dumb hub and putting the IDS box on it with the router and suddenly I had all sorts of traffic on both ntop and snort. So I replaced the netgear switch with a brand new one we had in stock, reconfigured the monitor port, and everything worked just as it did on the hub.

Sorry this all ended up boiling down to a hardware issue. I hope this thread can still help others to diagnose a similar issue.

Thanks everyone for your suggestions.

Last edited by a2brute; 08-13-2009 at 01:55 PM.
 
Old 08-14-2009, 09:29 AM   #7
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Nevertheless, thanks for the closure. As a quick note, you have to pay attention to Snort sigs and the version # of the engine you're running. The sigs are not usually upwardly compatible when factoring in major version numbers (someone please correct me if I'm wrong but I think this is the case). That may have been your issue...not sure, though. I usually turn off Spyware sigs anyways.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Web Page Access and TCP Session shreks Linux - Networking 4 11-17-2008 09:58 AM
snort install using easyids fearnone Linux - Newbie 1 11-04-2008 02:44 PM
Need help with basic Snort rule to dectect string in a web page abefroman Linux - Software 8 08-19-2008 11:42 PM
ICMP traffic in Snort+BASE perfect_circle Linux - Security 2 04-16-2005 06:16 PM
RH & HP4050N PCL - page, pause, page, pause, page andguent Linux - Hardware 0 11-10-2003 08:35 AM


All times are GMT -5. The time now is 09:14 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration