[Snort-users] Do 1.9 rules work with 2.0?
erek at ...950...
Sun Apr 6 19:50:04 EDT 2003
On Sun, 6 Apr 2003, Jesse W. Asher wrote:
> Apologies if this has been asked and answered already. Do rules for
> snort 1.9 work with 2.0?
Somewhat, but you're better off running 2.0 rules with 2.0 instead. If
you're using the distributed rules, scrap your 1.9.x rules and migrate to
> Are there any downsides to running 2.0 vs. 1.9? Thanks!!
Not really. 2.0 has a bigger memory footprint, but it's also about 18x
faster. :) If you're on a box with a small amount of memory, there is a
lowmem config option that can cut down on the memory usage.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-users