# Ban escalation time

**URL:** <https://discourse.crowdsec.net/t/ban-escalation-time/1024>\
**Category:** crowdsec\
**Created:** [November 15, 2022, 4:17am UTC](https://discourse.crowdsec.net/t/ban-escalation-time/1024 "2022-11-15T04:17:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ayucel](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@ayucel](https://discourse.crowdsec.net/u/ayucel)\
**Post date:** [November 15, 2022, 4:17am UTC](https://discourse.crowdsec.net/t/ban-escalation-time/1024/1 "2022-11-15T04:17:10Z")

</div>

Hello there, I would like to add a ban time escalation every time an attack attempt comes in from the banned IP address and extends it’s expiration time. I know that this can be defined in profiles.yaml file, but I don’t exactly sure how that will look like. Does it has to be written in Go? Or is there something that I am missing?

Any source that I can refer to, would be much appreciated.

Thank you.

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [November 15, 2022, 11:22am UTC](https://discourse.crowdsec.net/t/ban-escalation-time/1024/2 "2022-11-15T11:22:00Z")

</div>

Hi @ayucel,

You can achieve it by following the doc: [Format | CrowdSec](https://docs.crowdsec.net/docs/next/profiles/format/#duration_expr)

The expression will generate a Golang duration and replace the default decision duration. So you need to be careful that your expression generates a valid duration. You have an example in the documentation that shows you how to do it.

---

<div class="post-metadata">

**Author:** ![ayucel](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@ayucel](https://discourse.crowdsec.net/u/ayucel)\
**Post date:** [November 15, 2022, 3:03pm UTC](https://discourse.crowdsec.net/t/ban-escalation-time/1024/3 "2022-11-15T15:03:45Z")

</div>

Hey @he2ss,

Thank you for the help.

---

<div class="post-metadata">

**Author:** ![smu44](https://avatars.discourse-cdn.com/v4/letter/s/4bbf92/32.png) [@smu44](https://discourse.crowdsec.net/u/smu44)\
**Post date:** [November 17, 2022, 6:43am UTC](https://discourse.crowdsec.net/t/ban-escalation-time/1024/4 "2022-11-17T06:43:02Z")

</div>

Won’t the expression lead to an overflow, exceeding maximum value ?

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [November 18, 2022, 10:00am UTC](https://discourse.crowdsec.net/t/ban-escalation-time/1024/5 "2022-11-18T10:00:01Z")

</div>

Hi, depends on the duration expression you will write. But if it starts with a small ban duration, you will probably not exceed the maximum because the attacker will stop attacking before (if he bans for 1 week for example).