**Instructions for Writing a Snort Rule**Using the following Snort rule as a model, write one rule that would detect all of the packets shown:```alert tcp any 80 -> any any (msg:”LOCAL my message”; content:”my content”; nocase; sid:1000110; rev:1;)```**Task: Write a rule which will match all the following packets:**1. **Packet 1:** - Source: `64.12.10.32:8437` - Destination: `204.126.133.22:80` - HTTP Method: `GET` - URI: `/item.php?id=2&and&1=1` 2. **Packet 2:** - Source: `64.12.10.47:8435` - Destination: `204.126.133.22:80` - HTTP Method: `GET` - URI: `/admin/sql/item.php?id=2/Setup.php` 3. **Packet 3:** - Source: `64.12.10.2:8439` - Destination: `204.126.133.22:80` - HTTP Method: `GET` - URI: `/admin/login/item.php?id=2/userinfo.php` 4. **Packet 4:** - Source: `64.12.10.18:2173` - Destination: `204.126.133.23:80` - HTTP Method: `POST` - URI: `/admin/adduser?item.php?id=2` 5. **Packet 5:** - Source: `64.12.11.2:2174` - Destination: `204.126.133.23:80` - HTTP Method: `GET` - URI: `/php2-1-1/admin/item.php?1=1`**Solution: Insert your answer below:**Answer:

Using the following snort rule as a model, write one rule that would detect all of the packets shown: alert tcp any 8O -> any any (msg:"LOCAL my message"; content:"my content"; nocase; sid:1000110; rev:1;) Write a rule which will match all the following: 1. 64.12.10.32:8437 -> 204.126.133.22:80 GET /item.php? id=2&and&1=1 2. 64.12.10.47:8435 -> 204.126.133.22:80 GET /admin/sql/item.php? id=2/Setup.php 3. 64.12.10.2:8439 -> 204.126.133.22:80 GET /admin/login/item.php? id=2/userinfo.php 4. 64.12.10.18:2173 -> 204.126.133.23:80 POST /admin/adduser? item.php?id=D2 5. 64.12.11.2:2174 -> 204.126.133.23:80 GET /php2-1- 1/admin/item.php?1=1

Using the following snort rule as a model, write one rule that would detect all of the packets shown: alert tcp any 8O -> any any (msg:"LOCAL my message"; content:"my content"; nocase; sid:1000110; rev:1;) Write a rule which will match all the following: 1. 64.12.10.32:8437 -> 204.126.133.22:80 GET /item.php? id=2&and&1=1 2. 64.12.10.47:8435 -> 204.126.133.22:80 GET /admin/sql/item.php? id=2/Setup.php 3. 64.12.10.2:8439 -> 204.126.133.22:80 GET /admin/login/item.php? id=2/userinfo.php 4. 64.12.10.18:2173 -> 204.126.133.23:80 POST /admin/adduser? item.php?id=D2 5. 64.12.11.2:2174 -> 204.126.133.23:80 GET /php2-1- 1/admin/item.php?1=1

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

Using tcpdump,read the packets from tcpdump.pcap and filter packets to include ip address 184.107.41.72 and port 80 only. Write these packets to a new file and md5sum that file. what is the md5sum shown?
CIS269 **SEE ATTATCHED PICS FOR BEST TRANSLATION** Packet Translation Lab Break down the following IP datagram into its individual fields, listing the value of each. Hint: It’s an IP datagram containing a TCP segment containing another protocol… 45 00 00 31 94 00 40 00 80 06 1B 9F 80 A3 C9 29 D8 45 29 15 04 09 00 15 00 00 C3 A1 DF 65 A8 45 50 18 20 AA 8E 8C 00 00 43 57 44 20 66 75 6E 0D 0A
Write a Java program to create a TCP Socket program to receive an input message from client socket, reverse the input message and send it back to the client. Note that the program should have the comments embedded in it to explicitly explain why that code is being used. Explain in detail the client process and the server process with reference to the code given by you for this task.
Q1: The following is a dump of a UDP header in binary form 0100 0001 0010 0011 0100 0001 0010 0111 0000 0000 0010 1111 0100 0001 0011 1111 Find in decimal form the following: (a) Source port number (b) Destination port number (c) Total length of the UDP (d) Length of the data (e) Check sum. (5 Marks)
Java Network protocol programming You are required to program a client and a server application using TCP based socket. The client should send a message to the server of the following format Operation operand1 operand2 Where Operation is either add, subtract, multiply, or divide. Operand 1 and Operand2 are two integers. The server should distingues the required operation and perform it over the two operands. The result of carrying out this operation should be sent back to the client. The client should present the result to the user. The work have to be within a group of two. One student should focus on implementing the client side while the other should focus on the server. Both student should fully understand and be able to modify and explain both sides the client and the server. Rubrics are as follows 1- Well organized commented out code. : 2- Correct implementation of the protocol described above. 3- Clear and easy to use interface with the user. 4- Fully running code.
A TCP endpoint can abort the connection, which entails the sending of a RST Packet rather than a FIN. The endpoint then moves directly to TIMEWAIT. To abort a connection using the Berkeley socket library, one first sets the SOLLINGER socket option, with a linger time of 0. At this point an application close() triggers an abort as above, rather than the sending of a FIN.
Using the following snort rule as a model, write a rule that would detect all the packets shown (1-6): alert tcp any any -> any 80 (msg:"LOCAL my message"; content:"my content"; nocase; sid:1000110; rev:1;) Write a rule which will match all the following: 1. 64.12.10.32:8437 -> 204.126.133.22:80 GET /admin/scripts/setup.php 2. 64.12.10.47:8435 -> 204.126.133.22:80 GET /phpAdmin/Setup.php 3. 64.12.10.2:8439 -> 204.126.133.22:80 GET /php2-1- 10/siteadmin/login.php 4. 64.12.10.18:2173 -> 204.126.133.23:80 POST /admin/scripts/setup.php 5. 64.12.11.2:2174 -> 204.126.133.23:80 GET /php2-1- 10/admin/main/setup.php 6. 64.12.11.2:2176 -> 204.126.133.23:80 GET /ADMIN/PHP/SCRIPTS/login.ph e p Note: Full points are given only if your rule is precise and doesn't generate a lots of false positives. Answer:
Breakdown each part of the following rules and tell what each segment does iptables -t filter -A INPUT -s 221.98.146.40 -j DROP i. What would happen here if we omitted the ‘-t filter’option? iptables -A INPUT -p tcp --dport ssh -j DROP c. iptables -A INPUT -p udp --dport ftp -j REJECT d. iptables -A INPUT -p tcp --dport 443 -j ACCEPT e. iptables -A INPUT -m iprange --src-range 192.168.40.25-192.168.40.35 -j DROP
Explain what this rule does: alert tcp any any -> 192.168.1.0/24 80 (content:”|A1 CC 35 87|”; msg:”accessing port 80 on local”).
I made a TCP server using socket python,basically my server can: - Upload (“put”) request: The client should, at the very least, open (in binary mode) the local file defined on the command line, read its data, send it to the server through the socket, and finally close the connection. - Download (“get”) request: The client should, at the very least, create the local file defined on the command line (in exclusive binary mode), read the data sent by the server, store it in the file, and finally close the connection. To avoid accidents, the client should deny overwriting existing files. - Listing (“list”) request: the client should, at the very least, send an appropriate request message, receive the listing from the server, print it on the screen one file per line, and finally close the connection. I want you to draw an ER diagram that can show the process above please.
msh7.c can be terminated with axit , but msh8.c cannot. Is this true? Yes! No!
Write a rule that will alert on any source IP on any port connecting to any destination IP address on the FTP control port that is referencing the content "Answers.doc". Provide the message of "Bad Student" when this information is found. Use a SID of 1, do not provide spaces in between the parameters delimited by a semicolon, using the order msg, content and sid. An incomplete example of the rule with the correct syntax is: alert tcp any any -> any any (msg: "Test1";sid:1;)