LX0-104 · Question #419
Which of the following is NOT included in a Snort rule header?
The correct answer is D. packet byte offset. A Snort rule header typically includes the rule action, protocol, source/destination IP addresses, and source/destination ports, but it does not specify a packet byte offset.
Question
Options
- Aprotocol
- Baction
- Csource IP address
- Dpacket byte offset
- Esource port
How the community answered
(37 responses)- B3% (1)
- C3% (1)
- D89% (33)
- E5% (2)
Why each option
A Snort rule header typically includes the rule action, protocol, source/destination IP addresses, and source/destination ports, but it does not specify a packet byte offset.
The protocol (e.g., tcp, udp, icmp, ip) is a mandatory component of a Snort rule header.
The action (e.g., alert, log, pass) is the very first component specified in a Snort rule header.
The source IP address is a mandatory component in a Snort rule header, specifying the origin of the traffic.
The packet byte offset refers to a specific position within the packet payload and is typically part of the rule options (e.g., used by the `offset` keyword within the content option) rather than a fundamental component of the rule header.
The source port is a mandatory component in a Snort rule header, specifying the origin port of the traffic.
Concept tested: Snort rule header components
Source: https://www.snort.org/documents/snort-users-manual
Topics
Community Discussion
No community discussion yet for this question.