nerdexam
EC-Council

312-50V11 · Question #93

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

The correct answer is D. An alert is generated when a TCP packet originating from any IP address is seen on the network and. This question tests the ability to correctly parse a Snort rule and identify the source, destination, protocol, and alert trigger condition.

Evading IDS, Firewalls, and Honeypots

Question

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

Options

  • AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and
  • BAn alert is generated when any packet other than a TCP packet is seen on the network and destined
  • CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the
  • DAn alert is generated when a TCP packet originating from any IP address is seen on the network and

How the community answered

(44 responses)
  • A
    14% (6)
  • B
    2% (1)
  • C
    7% (3)
  • D
    77% (34)

Why each option

This question tests the ability to correctly parse a Snort rule and identify the source, destination, protocol, and alert trigger condition.

AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and

This reverses source and destination - the rule places 192.168.1.0/24 on the right side of the arrow, making it the destination, not the origin of the alerting traffic.

BAn alert is generated when any packet other than a TCP packet is seen on the network and destined

The rule explicitly begins with the 'tcp' protocol keyword, so it only matches TCP packets and does not alert on non-TCP traffic.

CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the

Port 111 appears after the destination IP in the rule, making it the destination port on the subnet, not the source port of the originating host.

DAn alert is generated when a TCP packet originating from any IP address is seen on the network andCorrect

The rule format 'alert tcp any any --> 192.168.1.0/24 111' specifies any IP on any source port as the origin, and the 192.168.1.0/24 subnet on destination port 111 as the target. An alert fires when a TCP packet originating from any IP address is observed on the network and destined for that subnet on port 111 containing the mountd RPC payload bytes. Option D correctly identifies any-source TCP traffic destined for the monitored subnet as the trigger condition.

Concept tested: Snort IDS rule syntax parsing and interpretation

Source: https://docs.snort.org/rules/headers/ports

Topics

#Snort rules#IDS signatures#TCP traffic analysis#rule interpretation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice