[Snort-users] Do 1.9 rules work with 2.0?

Erek Adams erek at ...950...
Sun Apr 6 19:50:04 EDT 2003


On Sun, 6 Apr 2003, Jesse W. Asher wrote:

> Apologies if this has been asked and answered already.  Do rules for
> snort 1.9 work with 2.0?

Somewhat, but you're better off running 2.0 rules with 2.0 instead.  If
you're using the distributed rules, scrap your 1.9.x rules and migrate to
2.0 entirely.

> Are there any downsides to running 2.0 vs.  1.9?  Thanks!!

Not really.  2.0 has a bigger memory footprint, but it's also about 18x
faster.  :)  If you're on a box with a small amount of memory, there is a
lowmem config option that can cut down on the memory usage.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-users mailing list