LOL, thanks I did try Google before posting but obviously didn't look very hard!

@Tim,
I found it by googling "man snortsam.conf"

Yes sir it sure is. I found it in documentation for SnortSam. Below is the link I found it at.

http://doc.emergingthreats.net/bin/view/Main/SnortSamREADMEconf

All I was trying to do was increase the time an IP would be blocked by the IPS.

I've not come across that before - is it documented anywhere?

You can do that at IP level (or subnet) from snortsam.conf but not at rule level. If you are trying to block an IP completely why not just create a permanent firewall rule?

I am not saying you are incorrect but I was indeed able to do it from editing the snortsam.conf file with the below entry. I have verified through the logs that is working as intended.


atleast 127.0.0.1/32, 1 week

Assuming you are talking about the IPS, it is not in a conf file. It is contained within an individual rule, so you'd need to find and edit the rule.