nerdexam
EC-Council

312-50V10 · Question #93

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

The correct answer is D. An alert is generated when a TCP packet originating from any IP address is seen on the network and. The Snort rule triggers an alert when any TCP packet from any source IP and port is destined for port 111 on any host in the 192.168.1.0/24 network and matches the mountd RPC content signature.

Evading IDS, Firewalls, and Honeypots

Question

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

Options

  • AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and
  • BAn alert is generated when any packet other than a TCP packet is seen on the network and destined
  • CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the
  • DAn alert is generated when a TCP packet originating from any IP address is seen on the network and

How the community answered

(32 responses)
  • A
    16% (5)
  • B
    3% (1)
  • C
    6% (2)
  • D
    75% (24)

Why each option

The Snort rule triggers an alert when any TCP packet from any source IP and port is destined for port 111 on any host in the 192.168.1.0/24 network and matches the mountd RPC content signature.

AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and

The source field in the rule is 'any', not limited to the 192.168.1.0 subnet - the subnet is the destination, not the source.

BAn alert is generated when any packet other than a TCP packet is seen on the network and destined

The rule explicitly specifies 'tcp' as the protocol, so it only evaluates TCP packets, not any other protocol.

CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the

Port 111 appears on the right side of the directional arrow as the destination port, not as the source port of the originating connection.

DAn alert is generated when a TCP packet originating from any IP address is seen on the network andCorrect

The rule header 'alert tcp any any --> 192.168.1.0/24 111' specifies any source IP and any source port, with the destination being the 192.168.1.0/24 subnet on port 111. The content option matches the mountd RPC program number bytes, confirming the alert fires on inbound mountd access attempts targeting that subnet.

Concept tested: Snort rule syntax and directional header interpretation

Source: https://docs.snort.org/rules/headers/ports

Topics

#Snort rules#IDS signatures#network alerting#rule interpretation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice