<![CDATA[Odd SNORT Block Entries]]>Ever since I upgraded I usually get block alerts with why they were blocked. I now have a ton of entries just showing "N/A". Anyone run into this or know why these are showing no info?

]]>https://forum.netgate.com/topic/76676/odd-snort-block-entriesRSS for NodeMon, 20 Apr 2026 15:51:49 GMTMon, 08 Dec 2014 03:52:43 GMT60<![CDATA[Reply to Odd SNORT Block Entries on Tue, 09 Dec 2014 00:41:19 GMT]]>Thanks Guys!

]]>https://forum.netgate.com/post/500092https://forum.netgate.com/post/500092Tue, 09 Dec 2014 00:41:19 GMT<![CDATA[Reply to Odd SNORT Block Entries on Mon, 08 Dec 2014 23:29:37 GMT]]>BBcan177 is correct.  The BLOCKS tab simply grabs the blocked IPs from the <snort2c>table for display.  There is no information available from that table other than the IP.  In an attempt to provide a little more information, the code goes to the alerts log file for each Snort interface and tries to find those IP addresses.  For each match, it pulls some data from the alerts log to display on the BLOCKS tab (the time of the event and the message, for example).  If the alerts log has been cleared out, then when the BLOCKS tab code tries to look up the IP addresses it can't find them.

Bill</snort2c>

]]>https://forum.netgate.com/post/500085https://forum.netgate.com/post/500085Mon, 08 Dec 2014 23:29:37 GMT<![CDATA[Reply to Odd SNORT Block Entries on Mon, 08 Dec 2014 03:57:02 GMT]]>Hi ghostshell,

If you "Cleared" the Events in the Alerts Tab, those cleared entries will show as "N/A" in the Blocked Tab, until you clear the "Blocked Tab".

]]>https://forum.netgate.com/post/499908https://forum.netgate.com/post/499908Mon, 08 Dec 2014 03:57:02 GMT