Note: This contradictory behavior is related to the HIDS configuration. You are running
Snort in passive mode.Recall from the initial examination of Snort's configuration that it is
not configured in inline mode. In this configuration Snort cannot drop, sdrop or reject
packets. It is possible to manipulate multiple networking interfaces on a system to
emulate HIPS, but actually doing that is outside the scope of lab. The Snort FAQ will further
tell you that Snorthos to be running in inline mode to drop packets. When running in
passive mode, drop rules are not loaded, which Is why the first attempt ran the detection
rule. Reject rules are loaded, but not effective which is why the
reject rule, but the ping still worked.
27. Document this protection deficiency and suggest an alternative for
Demand protecting the vulnerable WebServert?from insider attacks for Secure Labs on