SNORT Regression Remove Blocked Hosts interval / Alert length of time / duration of block GUI changed automatically to 5 mins

JonathanLee · Oct 10, 2023, 6:24 AM

Hello fellow Netgate Community Members can you please help?

I use to have a 1 hour duration on my Snort config for blocked addresses. That option is now missing. Has anyone else noticed this regression?

How can I add in my 1 hour block into custom options to fix the regression?

Timeframe of block is no longer listed in GUI has it moved?

JonathanLee · Oct 10, 2023, 5:46 AM

Example from researching:

<minute>/20</minute>
<hour></hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 1200 snort2c

I can not find anymore in the config file for snort

all I see that is close is . . .

I use to have it set to an hour, however today it seems like its only 3-5 mins and clears and I can't change it.

JonathanLee · Oct 10, 2023, 5:56 AM

Remove blocked host interval . .

JonathanLee · Oct 10, 2023, 5:59 AM

Never does not work any longer it changed overnight to 5 mins for some reason, memory use I suspect.

Before

After