Re: Snort 1.9 vs 2.0

[Chris Green <cmg () sourcefire com>]

[ note: what I'm saying only applies to 2.0+ ]

"Hervé Debar" <herve.debar () francetelecom com> writes:
> So IIUC, snort-devel on snort.org is snort 2.0 on sourcefire, right ?
>
> Am I right in assuming that the rule writing is also changing ?
>
> Thanks,

The biggest end user change in this is that rule ordering matters a
lot less than it used to. If you specify content options in a rule,
multiple matches will alert on the longest singular content match.

That decision was made to most closely approximate how the snort rule
set was written with

most exact
less exact
catch all

rule systems
-- 
Chris Green <cmg () sourcefire com>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users