Using the following snort rule as a model, write a Snort rule which will detect your action of sending a request to a Google web server from your computer in your home or classroom. Assume that snort's sensor is at the classroom subnet perimeter (at your home network perimeter, connected to the home router), detecting packets and sending to Snort engine. You do not need to include the 'content' option field. Note: you need to add all the fields necessary in the blank spaces so that the rule does the job i.e. detecting the packet and sounding the alarm. Make sure 'msg' parameter/value is meaningful (describes well what the rule does) and makes sense. Also, make sure that you have the parameters for the 4-tuple. alert tcp any -> |(msg:"LOCAL "; sid:100000001; rev:1;)

Database System Concepts
7th Edition
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Chapter1: Introduction
Section: Chapter Questions
Problem 1PE
icon
Related questions
Question
**Creating a Snort Rule to Detect Google Requests**

*Objective:* Learn how to write a Snort rule to detect requests to Google web servers from a computer in a home or classroom network.

**Instructions:**

Using the template below, create a Snort rule that triggers an alert when a computer in your network sends a request to a Google web server. Assume the Snort sensor is positioned at the classroom subnet perimeter or home network perimeter, connected to the home router, to monitor and send packet data to the Snort engine.

**Important:**
- Fill in the blanks with the appropriate data necessary for the rule to detect the packet and trigger an alarm effectively.
- Ensure the 'msg' parameter is descriptive and accurate.
- Complete the parameters for the 4-tuple (i.e., source IP, source port, destination IP, destination port).

**Snort Rule Template:**

```
alert tcp <source IP> any -> <destination IP> <destination port> (msg:"LOCAL <description>"; sid:100000001; rev:1;)
```

- **Note**: Add the necessary information to replace the placeholders:
  - `<source IP>`: The IP address from which the request is being made.
  - `<destination IP>`: The Google server IP address.
  - `<destination port>`: Typically, HTTP port `80` or HTTPS port `443`.

Be sure to omit the 'content' option field, as it's not required for this exercise.

---

By following these guidelines, you can practice setting up Snort rules to enhance network security monitoring capabilities.
Transcribed Image Text:**Creating a Snort Rule to Detect Google Requests** *Objective:* Learn how to write a Snort rule to detect requests to Google web servers from a computer in a home or classroom network. **Instructions:** Using the template below, create a Snort rule that triggers an alert when a computer in your network sends a request to a Google web server. Assume the Snort sensor is positioned at the classroom subnet perimeter or home network perimeter, connected to the home router, to monitor and send packet data to the Snort engine. **Important:** - Fill in the blanks with the appropriate data necessary for the rule to detect the packet and trigger an alarm effectively. - Ensure the 'msg' parameter is descriptive and accurate. - Complete the parameters for the 4-tuple (i.e., source IP, source port, destination IP, destination port). **Snort Rule Template:** ``` alert tcp <source IP> any -> <destination IP> <destination port> (msg:"LOCAL <description>"; sid:100000001; rev:1;) ``` - **Note**: Add the necessary information to replace the placeholders: - `<source IP>`: The IP address from which the request is being made. - `<destination IP>`: The Google server IP address. - `<destination port>`: Typically, HTTP port `80` or HTTPS port `443`. Be sure to omit the 'content' option field, as it's not required for this exercise. --- By following these guidelines, you can practice setting up Snort rules to enhance network security monitoring capabilities.
Expert Solution
trending now

Trending now

This is a popular solution!

steps

Step by step

Solved in 2 steps

Blurred answer
Knowledge Booster
Hyperlinks
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.
Similar questions
Recommended textbooks for you
Database System Concepts
Database System Concepts
Computer Science
ISBN:
9780078022159
Author:
Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:
McGraw-Hill Education
Starting Out with Python (4th Edition)
Starting Out with Python (4th Edition)
Computer Science
ISBN:
9780134444321
Author:
Tony Gaddis
Publisher:
PEARSON
Digital Fundamentals (11th Edition)
Digital Fundamentals (11th Edition)
Computer Science
ISBN:
9780132737968
Author:
Thomas L. Floyd
Publisher:
PEARSON
C How to Program (8th Edition)
C How to Program (8th Edition)
Computer Science
ISBN:
9780133976892
Author:
Paul J. Deitel, Harvey Deitel
Publisher:
PEARSON
Database Systems: Design, Implementation, & Manag…
Database Systems: Design, Implementation, & Manag…
Computer Science
ISBN:
9781337627900
Author:
Carlos Coronel, Steven Morris
Publisher:
Cengage Learning
Programmable Logic Controllers
Programmable Logic Controllers
Computer Science
ISBN:
9780073373843
Author:
Frank D. Petruzella
Publisher:
McGraw-Hill Education