If the rule is Enabled and set to Drop is is automatically dropping the data. I'm not sure what you mean by Blackhole since that is generally an email term, but I think that Drop does what you want.
In my opinion it would be a stupid feature, because a port scan isn't a "real" attack. If a "good" user triggers the port scan detection he can't connect to your server for 24hrs. A "blocking"-feature for IDS rules would be nice but a 24hr block for a portscan is unnecessarily and afaik not available.
In my opinion it would be a stupid feature, because a port scan isn't a "real" attack. If a "good" user triggers the port scan detection he can't connect to your server for 24hrs. A "blocking"-feature for IDS rules would be nice but a 24hr block for a portscan is unnecessarily and afaik not available.
