Snort is not blocking
-
Hi
I've installed pfsense and snort on an alix.
snort package is 2.8.4.1_5 pkg.the log is sent to the syslog. this is running since 2 Month now. last week i've installed a jabber forward for emergency log, and remarked some strange behavior.
Mar 6 06:17:07 fw snort[52239]: [1:2006435:6] ET SCAN LibSSH Based SSH Connection - Often used as a BruteForce Tool [Classification: Misc activity] [Priority: 3]: {TCP} 209.59.179.117:34083 -> 10.1.0.2 :22
Mar 6 06:17:19 web sshd[7235]: Failed password for root from 209.59.179.117 port 34083 ssh2
I have a login attemp 12 sec after snort should have blocked the request.
On pf sense i see the drop quick rule for the snort2c table, the ip is in the table.Do I missunderstand something or is the blocking not realy working?
Thanks for your answers!
nufer