[Snort-devel] A smaller Snprt?

Chris Green cmg at ...402...
Wed May 29 04:04:02 EDT 2002


Erek Adams <erek at ...105...> writes:

> Ok, in an effort to build out a compact and 'tiny' package of snort, I've come
> up with some questions:
>
> 	1)  If I'm not using a plugin, and I _don't_ want to compile it in,
> what is the 'developer suggested' way that I remove it from the
> binary?

remove it from plugbase.c and remove it from Makefile.in and rerun automake.

> 	2)  'stripping' the binary should produce no ill effects,
> correct?

nope
> 	3)  Any other suggestions on shrinking the size of the snort
>  binary


You could rip out all the decoders in decode.c that don't apply to you
as well.

You could also use one of the binary compression
http://upx.sourceforge.net/ or gzexe

Thats probably your best bet for quick and easy.

http://nodevice.com/sections/ManIndex/man0538.html

> and associated files?
> 	4)  Other than bug hunting/tracking, would shrinking/stripping of the
> binary be a bad thing?


Nope.  The reason against stripping is that it means you can't do a
sensible backtrace
-- 
Chris Green <cmg at ...402...>
Fame may be fleeting but obscurity is forever.




More information about the Snort-devel mailing list