nerdexam
EC-Council

312-50V13 · Question #151

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

The correct answer is D. An alert is generated when a TCP packet originating from any IP address is seen on the network. The Snort rule alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";) generates an alert for TCP packets originating from any IP address and port that target the 192.168.1.0/24 subnet on port 111 and contain the specified hexadecimal content.

Submitted by the_admin· Mar 6, 2026Evading IDS, Firewalls, and Honeypots

Question

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

Options

  • AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and
  • BAn alert is generated when any packet other than a TCP packet is seen on the network and
  • CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the
  • DAn alert is generated when a TCP packet originating from any IP address is seen on the network

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    15% (3)
  • C
    10% (2)
  • D
    70% (14)

Why each option

The Snort rule `alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)` generates an alert for TCP packets originating from any IP address and port that target the 192.168.1.0/24 subnet on port 111 and contain the specified hexadecimal content.

AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and

The rule's source is `any any` (any IP, any port), not specifically from the `192.168.1.0/24` subnet, which is designated as the destination network.

BAn alert is generated when any packet other than a TCP packet is seen on the network and

The rule explicitly states `tcp`, indicating it only applies to TCP packets, not 'any packet other than a TCP packet'.

CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the

The rule specifies `any` for the source port and `111` for the destination port, not that the packet originates from port 111.

DAn alert is generated when a TCP packet originating from any IP address is seen on the networkCorrect

The rule explicitly specifies `tcp any any` as the protocol and source for the packet, meaning it will trigger an alert for any TCP packet originating from any IP address on any port that also matches the subsequent destination and content conditions. This option accurately describes the initial trigger condition regarding the source and protocol.

Concept tested: Snort rule syntax and interpretation

Source: https://www.snort.org/documents/snort-users-manual

Topics

#Snort rules#IDS#network intrusion detection#TCP

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice