IPS detecting/blocking nothing

[KPryor]

Up until February 24, my Untangle IPS was detecting and blocking numerous attacks per day. Since that day, not a single thing has been reported as detected or blocked. IPS does report how many sessions it scanned, but detections and blocks are always at zero. I'm trying to figure out why it went from something every day to absolutely nothing. Can anyone advise how I might determine what the situation is? It could just be my lack of understanding of the system, but I can't figure out why the drastic difference.

Thank you!
Ken

[KPryor]

Just an update in case anyone cares. As of this date, the IPS is still doing the same thing. 0 detections, 0 blocks when previously it was reporting detections and blocks regularly. I am having this issue on two different Untangle installs.

Is anyone else having this issue?

[WebFooL]

3991074 Scanned
3542 Logged
153 Blocked

And that is today :P

[KPryor]

Thanks for the information. It worked perfectly for a long time and then suddenly just stopped. I have the exact same problem on my home Untangle box and also on the 1 at my office.

KP

[adrianp918]

Sessions scanned 199708
2Sessions logged 0
Sessions blocked 0

[blueshoes]

Nothing here since Feburary also. I even redownloaded a new ISO thinking something was corrupt. Still nothing. It was frustrating when it did not work for years and then they made some changes and it started working. I must only work for some people because there are people that have it working. I am in bridge mode, does it not work in bridge mode and only works in gateway mode?

[f1assistance]

Anything new on this issue? I removed and reinstalled the module...still nothing
Sessions scanned 235888
Sessions logged 0
Sessions blocked 0

[KPryor]

Nope, nothing new as far as I know. Mine still isn't working and no one seems to know why. I'm thinking about switching to a different firewall setup. I understand I'm not a paying customer and they don't care about this issue, but even a simple reply that they've seen this topic would be nice.

[jcoffin]

It easy to verify IPS. Just looking one of the rules and create that type of session to check if IPS detects it.

Example SID: 664 SMTP RCPT TO decode attempt
http://www.securityfocus.com/bid/2308/discuss

[jcoffin]

Proof IPS does scan traffic.