Route10 Firmware 1.4l Released!

[jmszuch]

I think @ecs-solutions is referring to this behavior observed by @ebuckland81 here:

IDS/IPS automatically block attempting IP after X number of alerts

Sounds fair. Though, my conclusion is, like @DN3092 and @ecs-solutions, that it is or may be still slipping through and is not working as intended. Perhaps more guidance in how to prove that it actually works as intended is needed. I did some further testing running curl http://testmyids.com/ from a downstream S8 Switch. If it would be working as intended, I assume the response would be blocked but it came out as OK/200. I also modified the suricata.yaml to output the alerts to log file to…