Its actually the auto zap feature in my self-hosted Snort client I just found a way to give it a budget and the amount to zap and have it running on my home server :)