Firewall interaction with snort: unblocked a not blocked host

[ryanrowe]

I can't connect to a certain ip, and my filterlog shows that the ip is being blocked.

grepping the filter log (is this the right way of doing it?) I find three hits: 2x"(http_inspect) UNKNOWN METHOD" and 1x"(http_inspect) SIMPLE REQUEST".

Then I find "@51(1000000118) block drop log quick from any to snort2c:1215label "Block snort2c hosts"" somewhere else (I forget where).

But looking at the Snort blocklist, the ip is not shown. I increase the number of hosts shown until they are all shown - still nothing.

I cleared the blocklist, and now I can connect - but where else in the gui should I go to see which hosts are blocked, aside from the "Services/Snort/Blocked Hosts"?  :-\

Thanks.</snort2c:1215>

[rburdige]

You can check in the Tables Tabs.
Diagnostic -> Tables-> Select Snort2c from list.