312-50V9 · Question #518
Which of the following commands runs snort in packet logger mode?
The correct answer is B. ./snort -dev -l ./log. The -l flag directs Snort to log captured packets to a specified directory, which is the defining flag for packet logger mode.
Question
Which of the following commands runs snort in packet logger mode?
Options
- A./snort -dev -h ./log
- B./snort -dev -l ./log
- C./snort -dev -o ./log
- D./snort -dev -p ./log
How the community answered
(37 responses)- A5% (2)
- B92% (34)
- D3% (1)
Why each option
The -l flag directs Snort to log captured packets to a specified directory, which is the defining flag for packet logger mode.
The -h flag defines the home network CIDR for use in network IDS mode, not a log output path.
In Snort, the -l flag sets the logging directory and activates packet logger mode, causing Snort to write decoded packet data to that path. Combined with -d (application layer dump), -e (link-layer header display), and -v (verbose), the command ./snort -dev -l ./log captures and stores full packet detail to the ./log directory.
There is no -o flag that specifies a log directory in Snort; -o is used to change the rule evaluation order.
The -p flag suppresses promiscuous mode warnings and has no relation to enabling packet logging or specifying a log path.
Concept tested: Snort packet logger mode CLI flags
Source: https://www.snort.org/documents/snort-users-manual
Topics
Community Discussion
No community discussion yet for this question.