Writing Snort Rules

If you need to write a long rule in Snort, what symbol do you use?

• *

• l

• /

• \

What are the two sections of a Snort rule?

• header and options

• host and client

• internal and external

• action and process

The rule options section is:

• required

• defined by switches

• used to tighten rules and prevent false positives

• mandatory for alerts

Rule actions are implemented if:

• any of the conditions are true

• all of the conditions are true

• at least half of the conditions are true

• if two or more conditions are true

Rule options are identified by:

• ()

• ||

• \\

• //

In the example rule at the bottom of page 182, "content" and "msg" are

• commands

• rules

• keywords

• headers

In the example rule on page 182, "alert" is:

• action

• keyword

• header

• category

If you run Snort in "inline mode" it is:

• an out-of-band sniffer

• an out-of-band IDS

• an in-band IPS

• incapable of reviewing packet content

In order to force drop a suspicious packet, Snort would need to be configured:

• With the "drop" option

• In in-line mode

• with the "reject" switch

• using default settings.

What happens when Snort rejects a packet?

• It logs the packet but gives no user feedback

• It is sent to the ether

• It sends a "443" error to the sender

• It logs the packet and sends an "unreachable" message to the sender