Snort blocking for more than an hour
-
I was wondering if there is a way to change or have the option in the snort gui to change the amount of time snort blocks a host.
-
As of right now, no.
-
would modifying the crontrab entries (/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 1800 snort2c or /usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot) work?
-
Not on future versions, you need to modify the config.xml file.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.