312-50V11 · Question #625
Which of the following commands runs snort in packet logger mode?
The correct answer is B. ./snort -dev -l ./log. The -l flag in Snort specifies a log directory and activates packet logger mode, distinguishing it from sniffer or IDS modes.
Question
Which of the following commands runs snort in packet logger mode?
Options
- A./snort -dev -h ./log
- B./snort -dev -l ./log
- C./snort -dev -o ./log
- D./snort -dev -p ./log
How the community answered
(50 responses)- A2% (1)
- B86% (43)
- C8% (4)
- D4% (2)
Why each option
The -l flag in Snort specifies a log directory and activates packet logger mode, distinguishing it from sniffer or IDS modes.
The -h flag specifies the home network address range for use with CIDR notation, not a log output directory.
The -l ./log flag tells Snort to log decoded packet data to the specified directory, which is the defining switch for packet logger mode. Combined with -dev (decode, ethernet headers, verbose output), this command captures and stores full packet details to disk. Without -l, Snort runs in sniffer mode and does not persist packets.
The -o flag changes the order in which Snort applies pass, alert, and log rules - it is not related to output logging mode.
The -p flag disables promiscuous mode on the network interface, which affects packet capture behavior, not log file output.
Concept tested: Snort packet logger mode command flags
Source: https://docs.snort.org/start/installation
Topics
Community Discussion
No community discussion yet for this question.