Firewall interaction with snort: unblocked a not blocked host
-
I can't connect to a certain ip, and my filterlog shows that the ip is being blocked.
grepping the filter log (is this the right way of doing it?) I find three hits: 2x"(http_inspect) UNKNOWN METHOD" and 1x"(http_inspect) SIMPLE REQUEST".
Then I find "@51(1000000118) block drop log quick from any to snort2c:1215label "Block snort2c hosts"" somewhere else (I forget where).
But looking at the Snort blocklist, the ip is not shown. I increase the number of hosts shown until they are all shown - still nothing.
I cleared the blocklist, and now I can connect - but where else in the gui should I go to see which hosts are blocked, aside from the "Services/Snort/Blocked Hosts"? :-\
Thanks.</snort2c:1215>
-
You can check in the Tables Tabs.
Diagnostic -> Tables-> Select Snort2c from list.