from: http://snort2c.sourceforge.net/
<quote>Notes
It lacks "autodisable blocks" support for blocked ips.
Its not recommended use snort2c in production environments
or critical systems.
</quote>
Whats 'autodisable block' ?
In my experience, "autodisable block" means that a blocked IP will return to be permitted after x minutes. It is very usefull, because prevents that an attacker will lock you out using a lot of spoofed IPs...
My personal opinion is that an IPS is something too difficult to tune-up.. so pay attention!
Tom
