LFCS · Question #211
Which of the following methods can be used to deactivate a rule in Snort? (Select TWO correct answers)
The correct answer is A. Place a # in front of the rule and restart snort. B. Write a pass rule in local.rules and restart snort with the o option. Snort rules can be deactivated by either commenting them out or by introducing a higher-precedence pass rule that matches the same traffic.
Question
Options
- APlace a # in front of the rule and restart snort.
- BWrite a pass rule in local.rules and restart snort with the o option.
- CDelete the rule and snort will automatically reread its rules files within five minutes.
- DAdd the rule to /etc/snort/rules.deactivated and it will take effect immediately.
How the community answered
(22 responses)- A86% (19)
- C9% (2)
- D5% (1)
Why each option
Snort rules can be deactivated by either commenting them out or by introducing a higher-precedence pass rule that matches the same traffic.
Placing a hash symbol (#) at the beginning of a Snort rule comments it out, effectively disabling its functionality, and requires a Snort restart to load the updated rule set.
A `pass` rule, when placed with higher precedence (e.g., earlier in `local.rules` or included before other rule files) and matching the same traffic, instructs Snort to stop further rule processing for that packet, thereby deactivating an existing alert or log rule; Snort needs to be restarted for this change to take effect.
Deleting a Snort rule requires a restart of the Snort daemon to take effect, as Snort does not automatically reread its rule files on a timed interval.
Snort does not have a standard directory or mechanism like `/etc/snort/rules.deactivated` for immediately deactivating rules by simply moving them.
Concept tested: Snort rule management and deactivation methods
Source: https://www.snort.org/documents/snort_manual.pdf
Topics
Community Discussion
No community discussion yet for this question.