LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Closed Thread
 
LinkBack Search this Thread
Old 08-10-2009, 12:01 PM   #1
a2brute
Member
 
Registered: Feb 2005
Location: State of Denial
Distribution: (X/K)Ubuntu for desktop/laptop, DSL for old machines, Debian for Servers.
Posts: 36

Rep: Reputation: 15
Question Snort/Base reporting no traffic, Ntop not showing any TCP traffic.


Well, I tried this question under the Distributions forum, but have received no response, and I realized this is more likely an issue with Snort and Ntop configurations than a problem with the distro itself.

I have installed EasyIDS V0.3, and it went very smoothly. After the install, I logged in to the web GUI and configured the static IP for eth0 and changed the hostname. I also manually set eth1 to run in promiscuous mode, as it was not already configured to do so after the install.

The hardware setup is as follows:
1.8 GHz P4 (northwood)
512 MB DDR RAM
40 GB IDE HDD
Davicom PCI NIC (eth0)
Realtek PCI NIC (eth1)

The box is set up to monitor all traffic coming to and from the router within the LAN. Basically, to catch anything our firewall may not. We have a single 48 port Netgear switch (FS750T2) on which I have configured a "monitor" port which is connected to eth1 on the EasyIDS box, and I have included the port connecting the router in the monitor group.

The issue is that on the NTOP reporting pages there is no sign of any TCP traffic whatsoever. It shows UDP and BOOTP traffic, but no TCP.

Also, on the Base reporting pages, there is no sign of any activity at all, with the top line stating "Sensors/Total: 0/1"

I have tried to check the Snort logs for activity, but quickly discovered the logs must be binary since they only display a short line of garbled ASCII characters. I am also unable to locate logs for NTOP.

If anyone could give me some suggestions on how to troubleshoot this issue further, it would be greatly appreciated. I'm just not sure where else to look for signs of what may be misconfigured.
 
Old 08-10-2009, 12:21 PM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
a2brute, please don't do this. Instead, use the Report button on your post, in order to file a request with the moderators to have it moved to another forum. This thread is being closed because it's a duplicate.
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
EasyIDS help, no TCP traffic on NTOP page, no activity at all on base/snort page a2brute Linux - Distributions 6 08-14-2009 09:29 AM
Traffic shaping (limiting outgoing bandwidth of all TCP-traffic except FTP/HTTP) ffkodd Linux - Networking 3 10-25-2008 12:09 AM
nTop, port 0 traffic - help I am under attack! waffe Linux - Security 1 12-09-2005 07:53 AM
ICMP traffic in Snort+BASE perfect_circle Linux - Security 2 04-16-2005 06:16 PM
snort's reporting Bad traffic... TheIrish Linux - Security 4 12-02-2003 08:53 PM


All times are GMT -5. The time now is 10:51 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration