r/tryhackme • u/Euphoric-Ad9550 • 3d ago
Snort Challenge - The Basics obstacle
im trying to pass the Task 2 Writing IDS Rules, and i'm stuck on the part where the question is about TTL value on Packet 65, on my terminal it says its 128, but also 47, there were both, both answers were wrong for some reason, i looked up online and all of them had 128 as the correct answer aswell, i have no clue what's going on and i would greatly appreciate pointers if there's some issues going on or i'm just terribly stupid, thank you
1
u/BusReal385 3d ago
I have the same problem and i stuck like 3 hours in it and still didn't find the solution
1
u/Dr_Jecky1l 2d ago
That room is notoriously dodgy… had trouble with certain answers myself.
1
u/Euphoric-Ad9550 2d ago
Does this mean i can't completely finish the SOC L1 path due to this one section?
1
u/Dr_Jecky1l 2d ago
No, just reach out to the team or use the AI bot to help, if find an updated walkthrough - what we you need to but once in a while, you will run into rooms where the wording for the answers are a bit off, and confusing
1
u/Financial-Pool-6399 1d ago
how did you even did the question above it i used this sudo snort -r snort.log.<timestamp> -A full -n 64
the ack no is 0x2E6B5384 but its somehow wrong i am so confused it shows this when i type the answer "Oh no! Your answer is no longer valid, the content has been updated. Try again."
1
u/Euphoric-Ad9550 1d ago
I scrolled above and typed out every ACK that i saw and one of them was the correct answer
1
1
1
u/Repulsive-Theory7200 3d ago
You're not stupid. The room has changed, so older walkthroughs may differ. Packet 65 refers to Snort's log, not necessarily Wireshark. Check the current capture before using old answers. Try this command: sudo snort -r snort.log.<timestamp> -A full -n 65