What does this rule do? b. Comment on the significance of this rule if the Snort

A Guide to SQL
9th Edition
ISBN:9781111527273
Author:Philip J. Pratt
Publisher:Philip J. Pratt
Chapter7: Database Administration
Section: Chapter Questions
Problem 10RQ
icon
Related questions
Question

8.4 One of the non payload options in Snort is flow. This option distinguishes between clients and servers. This option can be used to specify a match only for packets flowing in one direction (client to server or vice versa) and can specify a match only on established TCP connections. Consider the following Snort rule: 

a. What does this rule do?

b. Comment on the significance of this rule if the Snort devices is placed inside or outside of the external firewall.

alert tcp SEXTERNAL_NET any -> $SQL SERVERS SORACLE_PORTS\
(msg: "ORACLE create database attempt:;\
flow: to server, established; content: "create database";
nocase; \
classtype: protocol-command-decode;)
Transcribed Image Text:alert tcp SEXTERNAL_NET any -> $SQL SERVERS SORACLE_PORTS\ (msg: "ORACLE create database attempt:;\ flow: to server, established; content: "create database"; nocase; \ classtype: protocol-command-decode;)
Expert Solution
trending now

Trending now

This is a popular solution!

steps

Step by step

Solved in 2 steps

Blurred answer
Knowledge Booster
Greatest Common Divisor
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.
Similar questions
  • SEE MORE QUESTIONS
Recommended textbooks for you
A Guide to SQL
A Guide to SQL
Computer Science
ISBN:
9781111527273
Author:
Philip J. Pratt
Publisher:
Course Technology Ptr