Scheduled emptying of block list?

[dhboyd26]

I know I can schedule things via cron and the like, but is there a command to empty the Snort/Suricata blocklist on a regular basis?  I know I can set how long a block lasts, but I want to be able to just empty the list on a regular basis.  We are having a tough time figuring out what rules are causing some of our critical services to be blocked, so for now, until I can sort it all out, i want to just dump the block list on a regular basis.

I've searched but not found anything on this, please simply point me in the right direction if you know there is a solution and I just couldn't search properly.

Thanks.

[BBcan177]

For the first few weeks or so, best to use Snort/Suricata in Non-Blocking mode…. This gives you time to tune it to your network without actually blocking anything...

otherwise this command will flush the table...

pfctl -t snort2c -T flush

[dhboyd26]

Thanks.  I would love to be running in NB mode, but we're in full swing for classes and if I run in NB mode the RIAA, MPAA and anyone else with copyright grievances will be breathing down my neck… students just won't turn off their BitTorrent clients.