LFCS · Question #420
What is the purpose of snort inline?
The correct answer is B. To have iptables use snort rules to filter packets. Snort inline mode functions as an Intrusion Prevention System (IPS), allowing Snort rules to directly influence packet filtering and dropping decisions within the network traffic flow, often integrated with firewall mechanisms like iptables.
Question
Options
- ATo run the snort daemon without forking child processes.
- BTo have iptables use snort rules to filter packets.
- CTo have snort log suspicious activity only, without performing any actions
- DTo run the snort daemon as a nonroot user.
How the community answered
(37 responses)- A5% (2)
- B92% (34)
- D3% (1)
Why each option
Snort inline mode functions as an Intrusion Prevention System (IPS), allowing Snort rules to directly influence packet filtering and dropping decisions within the network traffic flow, often integrated with firewall mechanisms like iptables.
Running Snort without forking child processes is related to its daemonization or execution mode, not the core purpose of "inline" functionality.
Snort inline, specifically `snort_inline`, is designed to work in conjunction with Linux `iptables` or other firewall solutions to perform active blocking or modification of traffic based on Snort rules, effectively acting as an Intrusion Prevention System (IPS).
Logging suspicious activity without performing actions describes Snort's Intrusion Detection System (IDS) mode, not its inline IPS mode, which does perform actions.
Running Snort as a non-root user is a security best practice for any daemon, but it is not the specific purpose or defining characteristic of "snort inline."
Concept tested: Snort inline IPS functionality
Source: https://www.snort.org/documents/snort-users-manual/snort_manual.pdf
Topics
Community Discussion
No community discussion yet for this question.