Why are the rules licensed separately from the software?

We are extremely committed to the advancement of Snort and the open source community. That commitment has resulted in advances such as gigabit performance capability, the integration of the IPS technology, the current and future generations of IP defragmentation and TCP stream reassembly functionality, protocol anomaly detectors and normalization, portscan detection, the unified output subsystem, reams of documentation, and many complete code audits. In addition, Cisco has dedicated significant resources to improving the quality, accuracy and timeliness of Snort rules. The nature of rule development and distribution has always made the rules research, development, and distribution a parallel process with Snort development, with its own licensing needs.