Member-only story
TryHackMe | Snort Challenge — The Basics | WriteUp
Put your snort skills into practice and write snort rules to analyse live capture network traffic
↓↓↓ Click here and earn $5 TryHackMe credit ↓↓↓
https://tryhackme.com/signup?referrer=62f3f5b5f9ea33006194e018
Find the room here: https://tryhackme.com/r/room/snortchallenges1
Task 1 Introduction
Read the task above.
No answer needed
Task 2 Writing IDS Rules (HTTP)
Navigate to the task folder.
Use the given pcap file.
Write a single rule to detect “all TCP port 80 traffic” packets in the given pcap file.
What is the number of detected packets?
Note: You must answer this question correctly before answering the rest of the questions in this task.
164
Investigate the log file.
What is the destination address of packet 63?
216.239.59.99
Investigate the log file.
What is the ACK number of packet 64?
