If the rule is Enabled and set to Drop is is automatically dropping the data. I'm not sure what you mean by Blackhole since that is generally an email term, but I think that Drop does what you want.
If the rule is Enabled and set to Drop is is automatically dropping the data. I'm not sure what you mean by Blackhole since that is generally an email term, but I think that Drop does what you want.
In my opinion it would be a stupid feature, because a port scan isn't a "real" attack. If a "good" user triggers the port scan detection he can't connect to your server for 24hrs. A "blocking"-feature for IDS rules would be nice but a 24hr block for a portscan is unnecessarily and afaik not available.
