ECCouncil 312-50 Exam Dumps & Practice Test Questions
Question 1:
Sandra, a new network intern at your organization, is learning how global IP address distribution is handled. She’s interested in the entities responsible for managing IP address resources across different regions and asks about the official organizations, known as Regional Internet Registries (RIRs), that oversee this process globally.
Which of the following choices correctly names four legitimate Regional Internet Registries (RIRs)?
A. APNIC, PICNIC, ARIN, LACNIC
B. RIPE NCC, LACNIC, ARIN, APNIC
C. RIPE NCC, NANIC, ARIN, APNIC
D. RIPE NCC, ARIN, APNIC, LATNIC
Correct answer: B
Explanation:
The global distribution and management of IP address space and related Internet number resources are overseen by five Regional Internet Registries (RIRs). These nonprofit organizations operate in distinct geographic regions and are responsible for allocating and managing public IP addresses and autonomous system (AS) numbers. The five legitimate RIRs are:
AFRINIC – African Network Information Centre (for Africa)
APNIC – Asia-Pacific Network Information Centre (for Asia-Pacific region)
ARIN – American Registry for Internet Numbers (for Canada, the US, parts of the Caribbean)
LACNIC – Latin America and Caribbean Network Information Centre (for Latin America and parts of the Caribbean)
RIPE NCC – Réseaux IP Européens Network Coordination Centre (for Europe, the Middle East, and parts of Central Asia)
Now, let’s evaluate each option:
A. APNIC, PICNIC, ARIN, LACNIC
Incorrect – While APNIC, ARIN, and LACNIC are valid RIRs, PICNIC is not a legitimate registry. It appears to be a made-up or joking acronym.
B. RIPE NCC, LACNIC, ARIN, APNIC
Correct – This option correctly lists four valid RIRs:
RIPE NCC (Europe/Middle East/Central Asia)
LACNIC (Latin America/Caribbean)
ARIN (US/Canada/parts of Caribbean)
APNIC (Asia-Pacific)
This is the most accurate and complete answer from the list.
C. RIPE NCC, NANIC, ARIN, APNIC
Incorrect – Although RIPE NCC, ARIN, and APNIC are valid, NANIC is not a real RIR. It appears to be either fabricated or a confusion with ARIN or another registry.
D. RIPE NCC, ARIN, APNIC, LATNIC
Incorrect – Again, RIPE NCC, ARIN, and APNIC are valid, but LATNIC is not a legitimate RIR. The correct registry for Latin America is LACNIC, not LATNIC.
The five official RIRs are AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. While AFRINIC is not included in this question, the only option that lists four correct and recognized RIRs is B. Therefore, the correct answer is B.
Question 2:
You're conducting a preliminary investigation on a competing company and remember that about a year ago, their website included a detailed staff list. The information is no longer available online, but you want to access that earlier version of the webpage.
What’s the best approach to retrieve previously published web content, such as the staff directory, that has since been removed?
A. Use Google’s cached version of the page.
B. Go to Archive.org and check past snapshots of the website.
C. Perform a full crawl of the existing website and store the results.
D. Search partner or affiliate websites for the same details.
Correct answer: B
Explanation:
When content is removed from a website but previously existed online, one of the most reliable and accessible ways to retrieve it is by using the Internet Archive, also known as Archive.org. This platform includes the Wayback Machine, a service that routinely takes and stores snapshots of web pages over time. These snapshots capture how a page looked on various dates, which allows users to view and retrieve old versions of webpages, including those that are no longer publicly available.
Here’s why each option stands as it does:
A. Use Google’s cached version of the page
This is not the best approach for retrieving older content (e.g., from a year ago). Google’s cache typically only stores the most recent version of a page and may overwrite older versions whenever the site is re-indexed. If the staff list was removed months ago, it’s highly unlikely to still exist in Google’s cache.
B. Go to Archive.org and check past snapshots of the website
This is the correct answer. Archive.org’s Wayback Machine allows users to input a URL and browse historical snapshots of the site. If the staff directory was present a year ago and the site was crawled at that time, you should be able to view that version and access the removed information. This is a common tool used in open-source intelligence (OSINT) and digital forensics.
C. Perform a full crawl of the existing website and store the results
This option is not effective in this context. Crawling the current website will not reveal content that has already been removed. While useful for archiving or analysis of active content, it won’t help recover previously published material that’s no longer available.
D. Search partner or affiliate websites for the same details
While occasionally helpful, this is not a reliable or direct method of retrieving the original content. Partner or affiliate websites might have some overlapping information, but there’s no guarantee they published the same staff directory. This is more speculative and secondary in nature.
The Wayback Machine at Archive.org is the most reliable and widely used tool for accessing historical web content, including pages that have since been modified or deleted. By checking archived snapshots from the timeframe when the content was live, users can retrieve previously available information such as staff directories, press releases, and product listings. Therefore, the correct answer is B.
Question 3:
Bill, a network administrator, is facing high traffic on his company’s network, mainly from one unknown IP. Tracing the IP reveals it originates from Panama. Suspecting a DoS attack, Bill decides to look up more information about the IP address.
To learn more about the suspicious IP located in Panama, which RIR should Bill consult?
A. LACNIC
B. ARIN
C. RIPELACNIC
D. APNIC
Correct answer: A
Explanation:
In this scenario, Bill has traced suspicious IP traffic to Panama, and he needs to find detailed information about the IP address’s ownership and allocation. The best source for this is the Regional Internet Registry (RIR) responsible for managing IP address space in the Latin America and Caribbean region.
There are five official RIRs globally, each serving a specific geographical region:
AFRINIC – Covers Africa
APNIC – Covers the Asia-Pacific region
ARIN – Covers the United States, Canada, and parts of the Caribbean
LACNIC – Covers Latin America and most of the Caribbean, including Panama
RIPE NCC – Covers Europe, the Middle East, and parts of Central Asia
Let’s evaluate the options:
A. LACNIC
Correct. The Latin America and Caribbean Network Information Centre (LACNIC) is the RIR responsible for IP address and AS number allocations in Latin America and much of the Caribbean. Since Panama falls within this region, LACNIC would be the authoritative source for WHOIS data, including the organization that owns the IP, contact information, and allocation dates.
B. ARIN
Incorrect. The American Registry for Internet Numbers (ARIN) manages IP allocations for Canada, the U.S., and some parts of the Caribbean, but not Central or South America. Panama is in Central America, so ARIN wouldn’t be the right registry for this IP.
C. RIPELACNIC
Incorrect. This appears to be a fabricated or incorrect combination of RIPE NCC and LACNIC. There is no such RIR as RIPELACNIC. It’s likely a distractor or typographical confusion.
D. APNIC
Incorrect. The Asia-Pacific Network Information Centre (APNIC) handles countries in the Asia-Pacific region, such as Australia, China, Japan, and India. It has no jurisdiction over IP address allocations in Latin America or Panama.
When investigating IP addresses and trying to trace ownership or origin, it is essential to consult the correct Regional Internet Registry (RIR) based on the geographic location of the IP in question. Since Panama is in the Latin America region, the appropriate RIR is LACNIC. LACNIC’s public WHOIS database allows for detailed lookup of IP allocations, helping administrators like Bill determine who controls a given address and possibly initiate contact or mitigation. Therefore, the correct answer is A.
Question 4:
While analyzing a competitor's digital footprint, your lab partner wants to investigate a website with a ".com" domain to determine IP ownership. She's planning to use a WHOIS lookup tool but isn’t sure which RIR to start querying.
Which RIR is most appropriate to begin with when investigating a .com domain’s associated IP information?
A. LACNIC
B. ARIN
C. APNIC
D. RIPE NCC
E. AfriNIC
Correct answer: B
Explanation:
When conducting a WHOIS lookup to determine IP address ownership for a website — even one with a generic top-level domain (gTLD) like .com — the key lies in identifying the geographic region where the IP address is registered, not the domain suffix. While “.com” domains are globally used and managed by registrars accredited by ICANN (not by RIRs), the IP address that the domain resolves to is what determines the appropriate Regional Internet Registry (RIR) to query.
Since many .com websites are hosted by service providers in North America, the associated IP addresses often fall under the jurisdiction of ARIN (American Registry for Internet Numbers). ARIN manages IP address allocations for Canada, the United States, and parts of the Caribbean. Therefore, for many commercial websites, ARIN is a logical first choice for a WHOIS IP query.
Here’s a breakdown of the choices:
A. LACNIC
This RIR manages IPs in Latin America and parts of the Caribbean. While it's entirely possible that a .com domain could resolve to an IP in this region, ARIN remains the most common first step for .com-based websites, especially if you don’t yet know the IP geography.
B. ARIN
Correct. Most hosting infrastructure for .com domains — particularly U.S.-based companies — uses providers whose IPs are assigned by ARIN. If you query an IP address from a .com site and it’s located in the U.S., ARIN’s WHOIS will return the registrant and contact details. If the IP isn’t under ARIN, the query usually includes a referral to the appropriate RIR (e.g., APNIC, LACNIC, etc.), making ARIN a convenient and effective starting point.
C. APNIC
This registry covers the Asia-Pacific region (e.g., China, India, Japan, Australia). If you already know the IP belongs to a host in Asia, then APNIC would be appropriate. However, without that knowledge, APNIC is not the best initial choice.
D. RIPE NCC
Covers Europe, the Middle East, and parts of Central Asia. Again, unless the IP is confirmed to be European, this is not the ideal starting point.
E. AfriNIC
Manages IP space for Africa. While an IP hosted in Africa could correspond to a .com domain, this is relatively rare and not typically the default for most .com-hosted services.
While the .com domain itself is not tied to a specific region, the IP address it resolves to is geographically assigned and managed by a Regional Internet Registry. Because the majority of commercial and cloud hosting infrastructure — especially in the U.S. — uses IP space managed by ARIN, it is the most appropriate RIR to query first when conducting a WHOIS lookup for a .com domain's associated IP. If the IP falls outside ARIN’s region, the WHOIS response typically includes a referral to the correct RIR, making ARIN an efficient and practical first step. Therefore, the correct answer is B.
Question 5:
While analyzing logs from a honeypot setup, you find signs of intrusion attempts, some of which appear to have been successful. Using your understanding of OS fingerprinting, SQL injection indicators, and unauthorized user creation, you try to interpret the data accurately.
What is the most likely conclusion based on the log analysis and observed attack patterns?
A. The system is a Windows machine being probed unsuccessfully.
B. A web application was exploited using an SQL injection attack.
C. An attacker created a user account but didn’t gain access.
D. The true IP of the attacker is 24.9.255.53.
Correct answer: B
Explanation:
This scenario describes a honeypot environment where indicators of compromise (IoCs) such as OS fingerprinting, SQL injection attempts, and unauthorized user creation are observed. A proper interpretation of these signs helps determine how the attack unfolded and what vulnerability was exploited.
Let’s evaluate each option in light of typical log evidence and attack behavior:
A. The system is a Windows machine being probed unsuccessfully.
This might be a partial observation based on OS fingerprinting, where tools like Nmap are used to detect system types. However, the scenario clearly states that some intrusion attempts appear to have been successful. Therefore, this option fails to address the key part of the incident: a successful exploitation. It also doesn’t align with the presence of SQL injection indicators.
B. A web application was exploited using an SQL injection attack.
Correct. The most telling detail in the scenario is the reference to SQL injection indicators. SQL injection is a common vulnerability that attackers exploit to manipulate a web application’s database. It can lead to unauthorized access, data leakage, or even remote code execution, depending on how deep the attacker gets. The mention of successful attacks and SQL injection strongly points to this being the main method of intrusion.
In real-world log analysis, SQL injection indicators may include:
Suspicious URL query strings containing SQL keywords like OR 1=1, UNION SELECT, --, or '
HTTP requests with database-related error messages in the response
Repeated access to a particular form or URL with varying payloads
Given that SQL injection was observed and that the attack appears to have succeeded, this is the most likely conclusion.
C. An attacker created a user account but didn’t gain access.
While unauthorized user creation is a serious threat, this option suggests that the attacker did not succeed in gaining access, which contradicts the scenario’s wording — it mentions some attempts being successful. This answer might be plausible if logs only showed account creation attempts, but without evidence of further access or command execution.
D. The true IP of the attacker is 24.9.255.53.
This is speculative. While honeypots log IP addresses, attackers often use proxies, VPNs, or spoofed addresses, making it hard to assert any IP as definitively “true.” Additionally, this answer does not align with the focus of the scenario, which centers on understanding the nature of the attack, not the identity of the attacker.
The scenario involves clear indicators of a web-based attack, most notably SQL injection. These attacks exploit vulnerabilities in web applications to manipulate databases, potentially leading to account creation, data exfiltration, or privilege escalation. Since the logs confirm some attacks were successful, and SQL injection indicators were present, it is highly likely that the attacker exploited a web application through SQL injection — making B the best-supported conclusion.
Question 6:
You are examining how different port scanning techniques impact target behavior. In this case, you’re using a XMAS scan, which sets the FIN, PSH, and URG TCP flags. You want to understand how a system responds when the scanned port is actually closed.
What kind of reply should you expect from a target if a port is closed during a XMAS scan?
A. SYN
B. ACK
C. FIN
D. PSH
E. RST
F. No response
Correct answer: E
Explanation:
The XMAS scan is a type of stealth port scan used to identify open ports on a target system without completing a full TCP handshake. This scan sets the FIN, PSH, and URG flags in the TCP header—essentially “lighting up” the packet like a Christmas tree, hence the name “XMAS scan.”
This scanning method relies on how TCP/IP stacks respond to unexpected flag combinations that don’t correspond to normal connection establishment or termination procedures.
TCP/IP Behavior and Port States:
RFC 793 (which defines TCP behavior) does not specify how systems should handle packets with unusual flag combinations like those in a XMAS scan, so implementations vary. However, most systems behave in the following ways:
If the port is closed, a RST (Reset) packet is sent in response to a packet with abnormal flag combinations, like those in a XMAS scan.
If the port is open, there is no response. This is because the packet is unexpected, and the open port simply ignores it.
Therefore, the behavior expected when a port is closed is a RST response. This tells the scanning system that the port is not open and is actively rejecting unsolicited or malformed connection attempts.
Analysis of Answer Options:
A. SYN
Incorrect. A SYN packet is used to initiate a connection, not a response to one. A target system will not send a SYN in response to a XMAS scan.
B. ACK
Incorrect. An ACK flag alone or in response to a malformed packet would be unusual. ACKs are typically part of the normal TCP connection process or used in response to SYNs.
C. FIN
Incorrect. A FIN is used to gracefully close an open TCP connection. It is not a typical response to unexpected packets like a XMAS scan.
D. PSH
Incorrect. The PSH flag tells the receiver to push the buffered data to the application immediately. Again, it has no role in replying to a XMAS scan.
E. RST
Correct. This is the expected response when a XMAS scan hits a closed port. The system is rejecting the malformed or unauthorized packet.
F. No response
Incorrect for a closed port. This is what happens when the port is open — the XMAS scan gets no reply, which is used to infer the port’s availability.
The XMAS scan is a clever reconnaissance tool designed to evade some firewalls and intrusion detection systems by not following typical connection procedures. Its effectiveness depends on the quirks of how different TCP/IP stacks handle unexpected packet types. When targeting a closed port, the system’s standard behavior is to issue a RST packet to indicate that the port is not accepting connections. Therefore, the most accurate answer is E.
Question 7:
While probing a network, you notice that standard services are either hidden or using unconventional ports. Your traditional scan results are inconclusive, so you want to use a more advanced method to identify services using various IP-level protocols beyond TCP/UDP.
Which scanning technique would help you detect different IP protocol types in such a situation?
A. TCP ping scan using Nessus
B. Nmap scan with -sP for ping sweep
C. Netcat with UDP and executable flags
D. Nmap scan using -sO for IP protocol detection
Correct answer: D
Explanation:
This scenario describes a situation where traditional TCP/UDP-based scans are insufficient, possibly because services are using non-standard ports or are operating over non-TCP/UDP IP protocols (such as ICMP, GRE, IPsec, or other Layer 3 protocols). In such cases, standard port-scanning methods fail because they only target transport-layer services (TCP/UDP), whereas other protocols function at the network layer.
Nmap’s -sO Scan for IP Protocol Detection:
Nmap offers a specialized scanning option called -sO, which stands for IP Protocol Scan. Instead of scanning ports, this technique scans IP protocol numbers (as defined by IANA). Each protocol, such as TCP (6), UDP (17), ICMP (1), IGMP (2), GRE (47), and others, has a unique number. The -sO option sends probes for different protocol numbers to detect which are supported or active on the target host.
This kind of scan is particularly useful when:
Devices or services use non-TCP/UDP protocols, such as IPsec (ESP/AH) or custom VPN protocols
Standard ports have been obfuscated or hidden behind firewalls
Network intrusion detection systems (NIDS) are tuned only for TCP/UDP
You need to map protocols, not just open ports
For example, if a system is running IPsec tunnels using protocol 50 (ESP) or protocol 51 (AH), a TCP/UDP scan won’t show anything useful, but an IP protocol scan will identify those protocols.
Evaluation of Other Options:
A. TCP ping scan using Nessus
Incorrect. Nessus is a powerful vulnerability scanner, but a TCP ping scan will still only detect TCP-layer services. It won’t identify services using non-TCP/UDP protocols like GRE or ESP.
B. Nmap scan with -sP for ping sweep
Incorrect. The -sP option (now deprecated and replaced with -sn) in Nmap performs a host discovery or ping sweep to identify live hosts. It does not provide any information about services, ports, or protocols used.
C. Netcat with UDP and executable flags
Incorrect. Netcat is useful for manual TCP or UDP connections and banner grabbing. However, it cannot scan or identify non-transport layer protocols like GRE, ESP, or ICMP. It’s a low-level, manual tool that lacks the protocol discovery capabilities needed here.
D. Nmap scan using -sO for IP protocol detection
Correct. This scan detects supported IP-level protocols regardless of the transport layer. It helps uncover hidden or obscure services operating outside standard port mappings and is the appropriate choice in this context.
When traditional TCP or UDP scans fail due to non-standard service ports or non-TCP/IP protocols, a more nuanced approach is necessary. Nmap’s -sO IP protocol scan provides visibility into which IP protocols a host supports, going beyond the transport layer. It’s especially useful in advanced reconnaissance and penetration testing scenarios involving VPNs, custom tunneling, or layer 3-level services. Therefore, the best choice in this scenario is D.
Question 8:
You’re executing an Idle Scan using Hping2, leveraging a third-party system (zombie) to perform stealth port checks. You observe that while IPID values usually increase by one, occasionally they increment by more than one.
What does it most likely mean when the zombie’s IPID increases by more than one during an Idle Scan?
A. The zombie host is generating other traffic and isn’t idle.
B. A firewall with stateful inspection is interrupting the process.
C. Hping2 does not support idle scanning techniques.
D. The port being scanned is open on the target system.
Correct answer: A
Explanation:
An Idle Scan is a stealthy port scanning technique that allows an attacker to probe a target without sending packets directly to it from their own IP address. Instead, the scan leverages a third-party “zombie” host, which has predictable IP ID sequencing and low or no traffic. This technique takes advantage of how IP headers track the IP Identification (IPID) field.
The attacker follows these general steps:
Sends a SYN/ACK or other probe to the zombie to record its current IPID value.
Sends a spoofed SYN packet to the target, making it appear as if it came from the zombie’s IP.
The target responds (SYN/ACK if the port is open, RST if closed) to the zombie.
The attacker then queries the zombie again to check its new IPID value.
If the IPID has increased by 2, it suggests the zombie replied to an unsolicited SYN/ACK from the target, meaning the port on the target is open.
If the IPID increased by only 1, it implies the target responded with a RST (indicating the port is closed), and no reply was required from the zombie.
However, if the IPID increases by more than 1 or by unpredictable amounts, this invalidates the assumptions needed for an Idle Scan. The Idle Scan relies on the zombie host being “idle”—that is, not generating other IP traffic that could cause the IPID counter to increment independently of the scan.
Why the Correct Answer Is A:
A. The zombie host is generating other traffic and isn’t idle.
Correct. This directly explains the observed behavior: non-scan-related traffic causes IPID increments greater than expected. An active zombie cannot be relied upon for accurate inference of scan results.
Why the Other Options Are Incorrect:
B. A firewall with stateful inspection is interrupting the process.
Incorrect. While stateful firewalls can interfere with scanning, they don’t typically cause erratic changes in the zombie’s IPID. The firewall might block packets between the zombie and the target or attacker, but it doesn't explain varying IPID increments.
C. Hping2 does not support idle scanning techniques.
Incorrect. While Nmap is the most popular tool for idle scanning, Hping2 can be used to manually replicate the technique. The scenario assumes proper use of Hping2; the problem isn’t tool capability, but environmental reliability (i.e., zombie traffic).
D. The port being scanned is open on the target system.
Incorrect. If the port were open, you'd expect the IPID to increase by exactly 2 (one for the initial probe, one for the spoofed reply). An increment of more than 2 is not definitive evidence of an open port—it suggests interference or background traffic.
An Idle Scan is only accurate when the zombie host is quiet, with IPID values incrementing solely due to scan-induced responses. If the zombie is engaged in other traffic, the IPID increments become unreliable, and the scan results are compromised. Therefore, if the IPID increases by more than one or two without consistency, it’s most likely because the zombie is not truly idle, making A the best and most accurate answer.
Question 9:
You're learning about various TCP scanning methods and come across one technique where TCP packets are sent with no flags activated. This method helps avoid certain intrusion detection systems by not following conventional scanning patterns.
Which type of scan sends TCP packets with no flags set in order to analyze port status?
A. Open Port Scan
B. Null Scan
C. Xmas Scan
D. Half-Open Scan
Correct answer: B
Explanation:
TCP scanning is a core technique used in network reconnaissance and vulnerability assessments. It helps identify open, closed, or filtered ports by analyzing how systems respond to crafted packets. Among the lesser-known and more stealthy scan types is the Null Scan, which sends TCP packets with no flags set at all. This makes it distinct from other scan types like SYN (half-open), Xmas, or full connect scans.
A Null Scan is based on a quirk in the TCP specification. Normally, a valid TCP packet will have at least one control flag set (like SYN, ACK, FIN, etc.). When a packet arrives with no flags, many operating systems—particularly those that conform strictly to RFC 793—respond in a predictable way:
If the port is closed, the target system sends back a RST (reset) packet.
If the port is open, the system simply ignores the packet (no response), assuming it's irrelevant or malformed.
This behavior is useful for stealth scanning, as it can evade basic intrusion detection systems (IDS) that only look for common scan patterns, such as SYN or full TCP handshakes.
Breakdown of Answer Choices:
A. Open Port Scan
Incorrect. This is not a recognized TCP scan type. All scanning techniques aim to identify whether a port is open, but "Open Port Scan" is not a technical term or scanning method.
B. Null Scan
Correct. This scan sends TCP packets with no flags set. If the port is closed, a RST is returned; if open, there’s typically no response. It’s used for stealth and sometimes to bypass basic IDS and firewalls.
C. Xmas Scan
Incorrect. An Xmas Scan sets the FIN, PSH, and URG flags in the TCP header. It's called “Xmas” because the combination of flags lights up like a Christmas tree. It also relies on RFC 793 behavior but is more easily detectable than a Null Scan.
D. Half-Open Scan
Incorrect. Also known as a SYN Scan, this sends a SYN packet and, depending on the response (SYN/ACK for open or RST for closed), determines port status. It’s fast and stealthy but still uses a flag (SYN), so it doesn’t match the description of "no flags set."
The Null Scan is a stealth technique that sends TCP packets with no control flags set. It's effective against systems that conform to RFC 793, and it relies on analyzing whether a target port responds with a RST (closed) or no response (open). Because it deviates from normal TCP behavior, some intrusion detection systems may overlook it. This makes B the best and most accurate answer.
Question 10:
You’re using Snort to monitor network activity and want to log packets for later analysis instead of getting real-time alerts. You need the correct command to run Snort in logging mode, saving data to a specified directory.
Which command should you use to start Snort in packet logging mode and store logs in the './log' folder?
A. ./snort -dev -h ./log
B. ./snort -dev -l ./log
C. ./snort -dev -o ./log
D. ./snort -dev -p ./log
Correct answer: B
Explanation:
Snort is a powerful open-source intrusion detection and prevention system (IDS/IPS) that can operate in multiple modes: sniffer mode, packet logger mode, and network intrusion detection mode (NIDS). The scenario here focuses on packet logging mode, where Snort captures and stores packet data for later analysis, rather than issuing real-time alerts based on rules.
To run Snort in packet logging mode, the correct syntax includes:
-d: This dumps the application layer data (useful for deeper inspection).
-e: This logs the link layer headers.
-v: Enables verbose mode, which shows packet headers on the console.
-l <directory>: Specifies the log directory for packet storage.
Correct Option:
B. ./snort -dev -l ./log
Correct. This command runs Snort in packet logging mode with verbose and detailed output:
-d: Show application data in packets.
-e: Include link layer headers.
-v: Verbose output to console.
-l ./log: Log the captured packets into the ./log directory.
This is the exact combination required to log traffic to a specific folder while capturing all packet content.
Why the Other Options Are Incorrect:
A. ./snort -dev -h ./log
Incorrect. The -h flag in Snort defines the home network, not a log directory. Using -h ./log is a misuse, as ./log is not a network definition.
C. ./snort -dev -o ./log
Incorrect. The -o flag tells Snort to apply rules from the output plugin chain in a specific way, not to specify a log path. This would not result in packet logging to the ./log folder.
D. ./snort -dev -p ./log
Incorrect. The -p flag disables promiscuous mode. It has nothing to do with logging or specifying a directory, and adding ./log after it would be syntactically invalid in this context.
To log packets instead of just detecting them, Snort must be placed into packet logging mode, and a log directory must be specified using the -l flag. Combining this with -dev gives a detailed packet capture suitable for analysis. Therefore, the correct command to achieve this is:
