A colleague wrote rule 1000050 for the bad bot, set it to drop in BOT-IPS, attached the policy and deployed. The bot still reaches SRV, and there is not a single intrusion event. Three separate mistakes each keep the rule from firing.
The simulator ticks each one as soon as the network meets it.
On LAP1, send the bot: traffic tcp 203.0.113.10 80 payload "GET /index.html User-Agent: badbot/3". It arrives. Read show access-policy ACP1, show ips-policy BOT-IPS and show snort-rules.
The rule watches port 8080 and BadBot with exact case. Delete it and add it again for port 80 with nocase: drop tcp any any -> any 80 (msg:"Bad bot"; content:"badbot"; nocase; sid:1000050; rev:2;)
Deleting a rule clears its state: set 1000050 to drop in BOT-IPS again, and put BOT-IPS on HTTP-WEB, the inbound rule (it was on INSIDE-OUT, the outbound one).
Deploy. The bot is dropped by rule 1000050, and a browser still arrives.
