[Snort-users] Rule performance profiling question

waldo kitty wkitty42 at ...14940...
Thu Sep 16 11:27:20 EDT 2010


On 9/16/2010 09:19, Joel Esler wrote:
> No.  My guess was that waldo kitty was not running SO rules, and that's why they
> weren't loaded in his config.

this is exactly correct... i am not currently running the SO rules due to recent 
upgrades to snort and other factors among which is the necessity to figure out 
which SO rules set will properly operate in my environment... plus with the 
recent notification that older environments are no longer going to be serviced, 
that makes it a bit harder and may very well turn out that the SO rules simply 
cannot be used in said environment :?

>
> Which he agreed with in a different part of the email thread.
>
> J
>
> On Thu, Sep 16, 2010 at 9:07 AM, Andy Berryman <aberryman at ...14758...
> <mailto:aberryman at ...14758...>> wrote:
>
>     Joel wrote that they “both are SO rules.”
>
>     What does that have to do with it? Does it make a difference that they are
>     so rules?





More information about the Snort-users mailing list