Certified Ethical Hacker – CEH – 312-50 – Question248

You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration?
alert tcp any any -> 192.168.100.0/24 21 (msg: "FTP on the network!";)


A. An Intrusion Detection System
B. A firewall IPTable
C. A Router IPTable
D. FTP Server rule

Correct Answer: A

Explanation:

Snort is an open source network intrusion detection system (NIDS) for networks .
Snort rule example:
This example is a rule with a generator id of 1000001.

alert tcp any any -> any 80 (content:”BOB”; gid:1000001; sid:1; rev:1;)

References: http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node31.html