Snort/Base reporting no traffic, Ntop not showing any TCP traffic.
 

Well, I tried this question under the Distributions forum, but have received no response, and I realized this is more likely an issue with Snort and Ntop configurations than a problem with the distro itself.

I have installed EasyIDS V0.3, and it went very smoothly. After the install, I logged in to the web GUI and configured the static IP for eth0 and changed the hostname. I also manually set eth1 to run in promiscuous mode, as it was not already configured to do so after the install.

The hardware setup is as follows:
1.8 GHz P4 (northwood)
512 MB DDR RAM
40 GB IDE HDD
Davicom PCI NIC (eth0)
Realtek PCI NIC (eth1)

The box is set up to monitor all traffic coming to and from the router within the LAN. Basically, to catch anything our firewall may not. We have a single 48 port Netgear switch (FS750T2) on which I have configured a "monitor" port which is connected to eth1 on the EasyIDS box, and I have included the port connecting the router in the monitor group.

The issue is that on the NTOP reporting pages there is no sign of any TCP traffic whatsoever. It shows UDP and BOOTP traffic, but no TCP.

Also, on the Base reporting pages, there is no sign of any activity at all, with the top line stating "Sensors/Total: 0/1"

I have tried to check the Snort logs for activity, but quickly discovered the logs must be binary since they only display a short line of garbled ASCII characters. I am also unable to locate logs for NTOP.

If anyone could give me some suggestions on how to troubleshoot this issue further, it would be greatly appreciated. I'm just not sure where else to look for signs of what may be misconfigured.

a2brute, please don't do this. Instead, use the Report button on your post, in order to file a request with the moderators to have it moved to another forum. This thread is being closed because it's a duplicate.