GIAC GSEC Exam - Topic 8 Question 10 Discussion

Snort is a signature-based intrusion detection system.

Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the

network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol

(IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP).

The three main modes in which Snort can be configured are as follows:

Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console.

Packet logger mode: It logs the packets to the disk.

Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for

matches against a user-defined rule set.

Answer option C is incorrect. StealthWatch is a behavior-based intrusion detection system.

Answer option A is incorrect. RealSecure is a network-based IDS that monitors TCP, UDP and ICMP traffic and is configured to look for attack

patterns.