I re-read my reply and it sort of sounds like a rant and that was not the intent. It's just that this is a somewhat frequent complaint/request that I have answered a number of times.
If you consider that the vast majority of actual malicious attacks from the Internet are going to be using the equivalent of "throw away" IP addresses, then maintaining say 100,000 or more previously blocked IP addresses won't be very productive. The attacker will abandon one and just switch to some other IP address to spoof. So that attack yesterday from one address is likely to come from a new and different one today. So why burden your firewall with storing thousands and thousands of old blocked IPs? Also, what if this month 100 of the ones you blocked last month are now in use by legitimate web sites/users that mysteriously can't reach your system because of the block from last month?
If Snort (or Suricata) was smart enough to catch the attack and block it today from IP address 1.2.3.4, then why would you think it can't detect and block the same attack tomorrow from IP address 1.2.3.4? Why should it keep a running list of previous blocks? And so long as you don't reboot the firewall (and if you have the Clear Blocked Hosts parameter set to Never), then the IP will stay in the snort2c table and remain blocked until a reboot. However, I don't recommend folks run Snort that way. You want the blocked hosts to clear out on a fairly frequent basis. I personally have mine set to one hour. What if the block was just a false positive? Would you want the false positive to stay blocked forever? Likely not. So I recommend choosing a reasonably short interval for the Clear Blocked Hosts parameter, but not Never.
Bill
