1. What Snort rule could you have created to prevent this attack?

Use this template and

fill in the blanks, and do not use the "any" rule in your answer.

alert {BLANK} 10.42.0.0/{BLANK} any -> {BLANK} {BLANK} (msg:”Possible hacker alert!";
sid:1;)

IP Address Negation Rule

It alerts if it detects any traffic originating outside the local network

alert tcp ! 10.42.0.0/24 any -> 10.42.0.0/24 111 (content: "|00
01 86 a5|"; msg:”Possible hacker alert!"; sid:1;)