312-50V10 · Question #625
Which of the following commands runs snort in packet logger mode?
The correct answer is B. ./snort -dev -l ./log. Snort packet logger mode requires the -l flag to specify a log directory, instructing snort to capture and write full packet data to disk.
Question
Which of the following commands runs snort in packet logger mode?
Options
- A./snort -dev -h ./log
- B./snort -dev -l ./log
- C./snort -dev -o ./log
- D./snort -dev -p ./log
How the community answered
(44 responses)- A7% (3)
- B86% (38)
- C2% (1)
- D5% (2)
Why each option
Snort packet logger mode requires the -l flag to specify a log directory, instructing snort to capture and write full packet data to disk.
The '-h' flag defines the home network CIDR range used in snort's network intrusion detection mode for rule directionality, not a logging directory for packet logger mode.
The '-l' flag designates the output directory for packet logging and activates snort's packet logger mode. The full command './snort -dev -l ./log' uses -d to dump packet payload data, -e to display the data-link layer header, -v for verbose console output, and -l ./log to log all captured packets to the specified directory - which together constitute packet logger mode as defined in the snort manual.
'-o' in snort changes the rule application order (alert rules processed before pass rules) and has no function related to enabling or directing packet logging.
'-p' is not a recognized snort command-line flag for packet logging; it does not correspond to any logging or capture function in the snort architecture.
Concept tested: Snort operational modes and packet logger command syntax
Source: https://www.snort.org/documents
Topics
Community Discussion
No community discussion yet for this question.