Snort

Question 1

What is the de facto standard Network Intrusion Detection System?

Answer 1

Snort

Question 2

What are the 3 operational modes in Snort?

Answer 2

• Sniffer
• Packet Logger
• Network Intrusion Detection System (NIDS)

Question 3

What are 3 types of variables in Snort?

Answer 3

• var
• portvar
• ipvar

(If IPv6 is enabled on the network, but the network uses IPv4 then ipvar is used instead of var)

Question 4

What are plug-in tools that allow Snort® to look for certain criteria in a packet after it has been decoded but before it is put through the detection engine?

Answer 4

Snort Preprocessors

Question 5

Which keyword allows other rules files to be included within the rules file indicated on the Snort® command line. It tells Snort® which of the rule-set files to use.

Answer 5

Include

Question 6

Rules are divided into which two logical sections?

Answer 6

Rule Header - action, protocol, source and destination ports and IP addresses

Rule Options - which parts of the packet are inspected to determine if the rule action should be taken / Alert messages

Question 7

Which IP addresses are the source and destination:

[] [122:1:0] (portscan) TCP Portscan []
[Priority: 3] 02/28-07:50:46.477631 161.225.234.237 -> 172.16.90.33 PROTO:255 TTL:0 TOS:0x0 ID:52556 IpLen:20 DgmLen:172 DF

Answer 7

Source = 161.225.234.237

Destination = 172.16.90.33

Question 8

Which Snort rule action generates an alert using the selected alert method, and then logs the packet?

Answer 8

Alert

Question 9

Which Snort rule action logs the packet?

Answer 9

Log

Question 10

Which Snort rule action ignores the packet?

Answer 10

Pass

Question 11

Which Snort rule action alerts and then turns on another dynamic rule?

Answer 11

activate

Question 12

Which Snort rule action remains idle until activated by an activate rule, then acts as a log rule?

Answer 12

Dynamic

Question 13

Which Snort rule action makes IP-tables drop the packet, log it, and then send a TCP reset if the protocol is TCP or an ICMP port unreachable message if the protocol is UDP?

Answer 13

Reject

Question 14

Which Snort rules action makes IP-tables drop the packet but does not log it?

Answer 14

Sdrop

Question 15

What is the difference between the “drop” and “deny” Snort rule action?

Answer 15

“Drop” makes IP-tables drop the packet and logs it, “Deny” drops the packet and sends alert that it was denied.

Question 16

The range operator indicated with a “:”, allows you to block entire subnets. Why might this be a poor practice?

Answer 16

You may block something you want

Question 17

Snort rule options are separated from one another using which character?

Answer 17

”;” (semi-colon)

Question 18

Which keyword is used to uniquely identify Snort rules?

Answer 18

SID (Snort identifier)

Question 19

(T/F) You should write rules that target the vulnerability, instead of a specific exploit

Answer 19

True

Question 20

Can you have a packet that is both TCP and UDP?

Answer 20

No. Each packet has one number that represents which protocol it is.