Snort is not blocking

  • Hi
    I've installed pfsense and snort on an alix.
    snort package is pkg.

    the log is sent to the syslog. this is running since 2 Month now. last week i've installed a jabber forward for emergency log, and remarked some strange behavior.

    Mar  6 06:17:07 fw snort[52239]: [1:2006435:6] ET SCAN LibSSH Based SSH Connection - Often used as a BruteForce Tool [Classification: Misc activity] [Priority: 3]: {TCP} -> :22

    Mar  6 06:17:19 web sshd[7235]: Failed password for root from  port 34083 ssh2

    I have a login attemp 12 sec after snort should have blocked the request.
    On pf sense i see the drop quick rule for the snort2c table, the ip is in the table.

    Do I missunderstand something or is the blocking not realy working?

    Thanks for your answers!


Log in to reply