nerdexam
EC-Council

312-50V9 · Question #599

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

The correct answer is D. An alert is generated when a TCP packet originating from any IP address is seen on the network and. This question tests the ability to read and interpret Snort IDS rule syntax, specifically understanding source/destination direction and port assignment.

Evading IDS, Firewalls, and Honeypots

Question

Study the snort rule given below and interpret the rule. alert tcp any any --> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msG. "mountd access";)

Options

  • AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and
  • BAn alert is generated when any packet other than a TCP packet is seen on the network and destined
  • CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the
  • DAn alert is generated when a TCP packet originating from any IP address is seen on the network and

How the community answered

(30 responses)
  • A
    7% (2)
  • B
    17% (5)
  • C
    3% (1)
  • D
    73% (22)

Why each option

This question tests the ability to read and interpret Snort IDS rule syntax, specifically understanding source/destination direction and port assignment.

AAn alert is generated when a TCP packet is generated from any IP on the 192.168.1.0 subnet and

This reverses the source and destination - the rule specifies 192.168.1.0/24 as the destination network, not the source of the TCP packet.

BAn alert is generated when any packet other than a TCP packet is seen on the network and destined

The rule explicitly specifies 'tcp' as the protocol, so it only matches TCP packets, not any other protocol type.

CAn alert is generated when a TCP packet is originated from port 111 of any IP address to the

Port 111 appears on the right side of the '-->' operator, making it the destination port, not the source port from which traffic originates.

DAn alert is generated when a TCP packet originating from any IP address is seen on the network andCorrect

In the Snort rule 'alert tcp any any --> 192.168.1.0/24 111', the format is: protocol source-IP source-port --> dest-IP dest-port. 'Any any' on the left means any source IP and any source port, while '192.168.1.0/24 111' on the right means the destination is the /24 subnet on port 111 (rpcbind/sunrpc). The rule fires when TCP traffic from any host targets port 111 on that subnet and matches the mountd byte-pattern content.

Concept tested: Snort IDS rule syntax and traffic direction interpretation

Source: https://docs.snort.org/start/rules

Topics

#Snort rules#IDS rule parsing#TCP traffic alert#network monitoring

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice