Unable to submit the task for IDS 1.3 Challenge Exercise

General
1

Hi Everyone,

I just completed the IDS basics exercise but I am unable to complete the challenge exercise. I have applied the first and second rules as instructed but when i click submit/complete it keeps telling me i am wrong. but I was able to achieve the outcome of the task in the lab with the same rule syntax:

  1. alert tcp any any → any 21 (msg: “FTP Traffic Detected"; sid:4;)
  2. alert tcp any 21 <> any any (msg: “FTP Traffic Detected”; sid:5;)
    Any help will be appreciated.
    image
    image883×645 42.4 KB
2

For the answer to #1, I see an arrow symbol, but it should be hyphen then greater than (->).

For both #1 and #2 remove the space between msg: and “FTP…”

Good (msg:"FTP…
Bad (msg: "FTP…

They might work fine but the grader is picky about spaces.

1 Like
3

Thanks, I removed the space as advised and it passed.

4

Hi Joseph,

i am facing same issue :-

image
image721×1108 43.3 KB

please help

1 Like
5

Hi GRV08,
I had similar issues, and although I know that the Snort rule is correct, when I tried posting the answer in the answer fields, I would get red fields of death.

I was originally trying it on Chrome browser, and switched to Safari and was able to get the credits for task 1.3

6

You may try using caps for FTP.

7

“red fields of death” LOL

8

I am having the same issue, but if I do one at a time they show passing, but if I put them both in then they both fail.

9

Just tested this lesson by inputting the correct answers together. I wasn’t able to reproduce an issue with the correct answers failing when submitted at the same time.

I would recommend double-checking the answers to confirm all of the spacing and special characters are correct.

1 Like
12

alert tcp any 21 <> any any (msg:“FTP Traffic Detected”; sid:4;)
alert tcp any 21 <> any any (msg:“FTP Traffic Detected”; sid:5;)

THIS IS CORRECT

13

The answer you show is not correct, but I would like to understand why you think it is correct?

If you want to argue that…

alert tcp any 21 <> any any (msg:“FTP Traffic Detected”; sid:4;)

OR

alert tcp any 21 <> any any (msg:“FTP Traffic Detected”; sid:5;)

…is sufficient to monitor FTP by itself, then I would agree. A single bi-directional rule would work.

In other words…

alert tcp any any - > any PORT (msg:“PORT Detected”; sid:4;)
alert tcp any PORT <> any any (msg:“PORT Detected”; sid:5;)

Is no better than…

alert tcp any PORT <> any any (msg:“PORT Detected”; sid:5;)

or even

alert tcp any any <> any PORT (msg:“PORT Detected”; sid:5;)

…by itself as <> will catch traffic to and from the PORT specified.

1 Like