[Snort-sigs] A suppressed IP address still got blocked

Glenn Ungaro gungaro at necscorp.com
Tue Dec 12 10:00:02 EST 2017

Hello All
I work for a MSP and we host several companies email. I have Snort running at the main client’s facility. 4 weeks ago the MSP’s barracuda was flagged by Snort as a possible spambot. I then put it in my suppress list and for some reason a few days ago it blocked the MSP’s barracuda again. Now I have Snort running as IDS now and the barracuda still has the same IP Address it always had. How can I make sure this won’t happen again if I turn Snort back to blocking. Snort is running on pfSense 2.2.4 with a Lanner router.
Any help is greatly appreciated.
Thank You

Glenn Ungaro
Asst. Network Administrator
Northeast Computer Corp.
gungaro at necscorp.com<mailto:gungaro at necscorp.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20171212/06b01b18/attachment.html>

More information about the Snort-sigs mailing list