Snort is not blocking

[nufer]

Hi
I've installed pfsense and snort on an alix.
snort package is 2.8.4.1_5 pkg.

the log is sent to the syslog. this is running since 2 Month now. last week i've installed a jabber forward for emergency log, and remarked some strange behavior.

Mar  6 06:17:07 fw snort[52239]: [1:2006435:6] ET SCAN LibSSH Based SSH Connection - Often used as a BruteForce Tool [Classification: Misc activity] [Priority: 3]: {TCP} 209.59.179.117:34083 -> 10.1.0.2 :22

Mar  6 06:17:19 web sshd[7235]: Failed password for root from 209.59.179.117  port 34083 ssh2

I have a login attemp 12 sec after snort should have blocked the request.
On pf sense i see the drop quick rule for the snort2c table, the ip is in the table.

Do I missunderstand something or is the blocking not realy working?

Thanks for your answers!

nufer