In: Computer Science
1. Which of the following statements are true of snort? (select all that apply)
Snort rules are free through community distribution
Snort rules can be written by users/administrators.
Snort rules allow the software to understand all unwanted traffic
Snort rules are free through subscription
What is Snort?
Snort is a free and open-source network intrusion prevention and detection system. It uses a rule-based language combining signature, protocol, and anomaly inspection methods to detect malicious activity such as denial-of-service (DoS) attacks, Buffer overflows, stealth port scans, CGI attacks, SMB probes, and OS fingerprinting attempts. It is capable of performing real-time traffic analysis and packet logging on IP networks.
Uses of Snort rules
Snort uses the popular libpcap library (for UNIX/Linux) or winpcap (for Windows), the same library that tcpdump uses to perform packet sniffing.
Snort’s Packet Logger feature is used for debugging network traffic.
Snort generates alerts according to the rules defined in configuration file.
The Snort rule language is very flexible, and creation of new rules is relatively simple.
Snort rules help in differentiating between normal internet activities and malicious activities.
An example for Snort rule:
log tcp !192.168.0/24 any -> 192.168.0.33 (msg: "mounted access" ; )
++### snort rule are free through Community distribution :-----
Community rules refer to all rules that have been submitted by members of the open source community or Snort Integrators. These rules are freely available to all Snort users and are governed by the GPLv2. If you wish to contribute, please send your rules along with and packet captures of the data to the Snort-sigs mailing list: Found here.The Community ruleset is available for download without registration.The Community Ruleset is a GPLv2 Talos certified ruleset that is distributed free of charge without any Snort Subscriber Rule Set License restrictions. This ruleset is updated daily and is a subset of the subscriber ruleset. If you are a Snort Subscriber Rule Set Subscriber, the community ruleset is already built into your download. If you are a registered user (under the 30-day delay) you may also include this ruleset in your Snort installation to stay current. The authors of the rules in the community ruleset are listed in the AUTHORS file inside the tarball.