Write a rule that will alert on any source IP on any port connecting to any destination IP address on the FTP control port that is referencing the content "Answers.doc". Provide the message of "Bad Student" when this information is found. Use a SID of 1, do not provide spaces in between the parameters delimited by a semicolon, using the order msg, content and sid. An incomplete example of the rule with the correct syntax is: alert tcp any any -> any any (msg: "Test1";sid:1;)
Write a rule that will alert on any source IP on any port connecting to any destination IP address on the FTP control port that is referencing the content "Answers.doc". Provide the message of "Bad Student" when this information is found. Use a SID of 1, do not provide spaces in between the parameters delimited by a semicolon, using the order msg, content and sid. An incomplete example of the rule with the correct syntax is: alert tcp any any -> any any (msg: "Test1";sid:1;)
Chapter8: Working With Advanced Functions
Section: Chapter Questions
Problem 4.4CP
Related questions
Question
![Write a rule that will alert on any source IP on any port connecting to any destination IP address on the FTP control port that is referencing
the content "Answers.doc". Provide the message of "Bad Student" when this information is found. Use a SID of 1, do not provide spaces in
between the parameters delimited by a semicolon, using the order msg, content and sid. An incomplete example of the rule with the correct
syntax is:
alert tcp any any -> any any (msg: "Test1";sid:1;)](/v2/_next/image?url=https%3A%2F%2Fcontent.bartleby.com%2Fqna-images%2Fquestion%2F82aefee1-a4fd-40e7-8b3f-97f92bfc6e2a%2Fd8e444ba-0137-421b-8e75-ac54bf4b0d19%2F6x08phlf_processed.png&w=3840&q=75)
Transcribed Image Text:Write a rule that will alert on any source IP on any port connecting to any destination IP address on the FTP control port that is referencing
the content "Answers.doc". Provide the message of "Bad Student" when this information is found. Use a SID of 1, do not provide spaces in
between the parameters delimited by a semicolon, using the order msg, content and sid. An incomplete example of the rule with the correct
syntax is:
alert tcp any any -> any any (msg: "Test1";sid:1;)
Expert Solution
![](/static/compass_v2/shared-icons/check-mark.png)
This question has been solved!
Explore an expertly crafted, step-by-step solution for a thorough understanding of key concepts.
This is a popular solution!
Trending now
This is a popular solution!
Step by step
Solved in 3 steps
![Blurred answer](/static/compass_v2/solution-images/blurred-answer.jpg)
Knowledge Booster
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.Recommended textbooks for you
Np Ms Office 365/Excel 2016 I Ntermed
Computer Science
ISBN:
9781337508841
Author:
Carey
Publisher:
Cengage
Np Ms Office 365/Excel 2016 I Ntermed
Computer Science
ISBN:
9781337508841
Author:
Carey
Publisher:
Cengage