Change block duration for Snort



  • Is it possible to change the number of days/hours that Snort will block an IP address for? It currently seems to be for a rather long period of time (>2 weeks) and I need to lower that down to something more like 2-3 days.

    Thanks,
    Daniel



  • In Snort -> Global Settings -> "Remove Blocked Hosts Interval" can be set between 15 minutes and 28 days.



  • d'oh.  Thank you.  I looked at that page a dozen times but was always looking for a text field to type a value into so kept looking over that one.