[Snort-users] [Snort-devel] About 64-bit snort binaries

Steven Sturges steve.sturges at ...1935...
Thu Mar 5 10:57:23 EST 2009

Yes, anything that relies on header files from Snort
that you are going to load into Snort as a shared
object, it needs to be built the same.

Output data types, such as unified2 and database, are
logging pieces of data, not specific data structures,
so the utilities that read those don't have to be built


Jason Zhao wrote:
> Thank you, Steven!
> Steven Sturges wrote:
>> Hi Jason--
>> That option is not required if your compiler builds 64bit
>> by default.  If you read the comment in configure.in just
>> prior to the checks for that option, it has to do with
>> allowing 64bit builds on machines where the compiler does
>> 32bit by default.
> Yes, I notice that, with "enable-64bit-gcc" during configure,
> which will add "-m64" to CFLAGS so that 64bit binary
> will be built.
>> On 64bit linux systems, you don't have to use that configure
>> option to get a 64bit binary with gcc.  I don't have a 64bit
>> Solaris system handy to play with, but if you notice, all it
>> does is add -m64 to the CFLAGS.
>> There isn't anything specific in Snort that is relying on
>> 32 vs 64 bit.  Pointer sizes would change.
>> The only real restriction is that the Snort binary and
>> the shared libraries must be the same (64bit or 32bit),
>> otherwise data structure sizes will likely cause a core
>> or other bus error.
> Thanks, the 64bit Snort binary depends on 64bit
> shared libraries. In this way, there may be some other
> utilities depend on the 64bit Snort plugin libraries(
> e.g., snort_dynamicengine) as long as those utilities
> are developed with 64bit. Do I understand right?
> Thanks
> Jason
>> Jason Zhao wrote:
>>> Hi, All,
>>> I am trying to build snort on Solaris. On configure script,
>>> it provides a option "--enable-64bit-gcc" to build 64bit
>>> snort and its plugin libraries. Through the test, the 32bit
>>> snort could work on Solaris very well. I am not sure about
>>> the difference with 64bit binary and 32bit one. Right now,
>>> I assume the plugin libraries(e.g., snort_dynamicengin) will
>>> use some 64bit feature, i.e., it is required to use 64bit
>>> plugins or 64bit snort binary on 64bit OS.
>>> Do I understand right?
>>> Great Thanks
>>> Jason

More information about the Snort-users mailing list