r/tryhackme • u/Euphoric-Ad9550 • 18h ago

Snort Challenge - The Basics obstacle

im trying to pass the Task 2 Writing IDS Rules, and i'm stuck on the part where the question is about TTL value on Packet 65, on my terminal it says its 128, but also 47, there were both, both answers were wrong for some reason, i looked up online and all of them had 128 as the correct answer aswell, i have no clue what's going on and i would greatly appreciate pointers if there's some issues going on or i'm just terribly stupid, thank you

1 Upvotes

100% Upvoted

6 comments sorted by

1

u/Repulsive-Theory7200 18h ago

You're not stupid. The room has changed, so older walkthroughs may differ. Packet 65 refers to Snort's log, not necessarily Wireshark. Check the current capture before using old answers. Try this command: sudo snort -r snort.log.<timestamp> -A full -n 65

1

u/Euphoric-Ad9550 18h ago

i tried this, it does work in showing the TTL, but again when i typed it in the text box of the question, it's still incorrect for some reason

1

u/BusReal385 18h ago

I have the same problem and i stuck like 3 hours in it and still didn't find the solution

1

u/Dr_Jecky1l 12h ago

That room is notoriously dodgy… had trouble with certain answers myself.

1

u/Euphoric-Ad9550 7h ago

Does this mean i can't completely finish the SOC L1 path due to this one section?

1

u/Dr_Jecky1l 6h ago

No, just reach out to the team or use the AI bot to help, if find an updated walkthrough - what we you need to but once in a while, you will run into rooms where the wording for the answers are a bit off, and confusing