Which statement best describes Snort?

Which statement best describes Snort?

• A. A password auditing tool
• B. A real-time network intrusion detection system that analyzes traffic and can detect port scans
• C. A hardware firewall
• D. A DNS resolver

Answer: (B)

Snort is a real-time network intrusion detection system that analyzes traffic and can detect port scans. It monitors network traffic (passively or in inline mode), applies a set of rules to identify known attack patterns, and raises alerts when something suspicious is observed. Its ability to detect port scans comes from signatures that recognize rapid, sequential connection attempts to many ports on a host, a common scanning technique used by attackers. This distinguishes it from a password auditing tool, which tries to crack credentials; a hardware firewall, which primarily filters traffic at the network edge; and a DNS resolver, which translates domain names to IP addresses.

Snort is a real-time network intrusion detection system that analyzes traffic and can detect port scans. It monitors network traffic (passively or in inline mode), applies a set of rules to identify known attack patterns, and raises alerts when something suspicious is observed. Its ability to detect port scans comes from signatures that recognize rapid, sequential connection attempts to many ports on a host, a common scanning technique used by attackers. This distinguishes it from a password auditing tool, which tries to crack credentials; a hardware firewall, which primarily filters traffic at the network edge; and a DNS resolver, which translates domain names to IP addresses.