Snort is not blocking



  • Hi
    I've installed pfsense and snort on an alix.
    snort package is 2.8.4.1_5 pkg.

    the log is sent to the syslog. this is running since 2 Month now. last week i've installed a jabber forward for emergency log, and remarked some strange behavior.

    Mar  6 06:17:07 fw snort[52239]: [1:2006435:6] ET SCAN LibSSH Based SSH Connection - Often used as a BruteForce Tool [Classification: Misc activity] [Priority: 3]: {TCP} 209.59.179.117:34083 -> 10.1.0.2 :22

    Mar  6 06:17:19 web sshd[7235]: Failed password for root from 209.59.179.117  port 34083 ssh2

    I have a login attemp 12 sec after snort should have blocked the request.
    On pf sense i see the drop quick rule for the snort2c table, the ip is in the table.

    Do I missunderstand something or is the blocking not realy working?

    Thanks for your answers!

    nufer


Log in to reply