[Snort-devel] A smaller Snprt?

Chris Green cmg at ...402...
Wed May 29 04:04:02 EDT 2002

Erek Adams <erek at ...105...> writes:

> Ok, in an effort to build out a compact and 'tiny' package of snort, I've come
> up with some questions:
> 	1)  If I'm not using a plugin, and I _don't_ want to compile it in,
> what is the 'developer suggested' way that I remove it from the
> binary?

remove it from plugbase.c and remove it from Makefile.in and rerun automake.

> 	2)  'stripping' the binary should produce no ill effects,
> correct?

> 	3)  Any other suggestions on shrinking the size of the snort
>  binary

You could rip out all the decoders in decode.c that don't apply to you
as well.

You could also use one of the binary compression
http://upx.sourceforge.net/ or gzexe

Thats probably your best bet for quick and easy.


> and associated files?
> 	4)  Other than bug hunting/tracking, would shrinking/stripping of the
> binary be a bad thing?

Nope.  The reason against stripping is that it means you can't do a
sensible backtrace
Chris Green <cmg at ...402...>
Fame may be fleeting but obscurity is forever.

More information about the Snort-devel mailing list