snort-inline-users

[Snort-inline-users] Snort installation on a Modem

[<Ash...@ar...>]

Hi,

I would like to install snort-inline on a modem that has typically 8MB 
flash. There will be no RAM in a modem. Execution space will be shared 
within that 8MB, I suppose. I have a compressed Linux OS in that flash. 
Since I have a little resource, I can allocate only 1MB for snort binary, 
though some space will be provided for snort running also.

From the version snort-inline-2.6.1.5 I got the binary of size 2.9MB. 
Please suggest some way to compress it as much as possible, I dont want 
any advanced pre-processors or modules. Just a basic working snort is 
sufficient.

Thanks,
Ashok SV

***********************  Aricent-Unclassified   ***********************
"DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of 
the individual to whom it is addressed. It may contain privileged or confidential information and should not be 
circulated or used for any purpose other than for what it is intended. If you have received this message in error, 
please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly
prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for 
loss or damage arising from the use of the information transmitted by this email including damage from virus."

Re: [Snort-inline-users] Snort installation on a Modem

[Will M. <wil...@gm...>]

Errrr where are you going to load your rules if there is no RAM?

On Fri, Feb 29, 2008 at 6:45 AM,  <Ash...@ar...> wrote:
>
> Hi,
>
> I would like to install snort-inline on a modem that has typically 8MB
> flash. There will be no RAM in a modem. Execution space will be shared
> within that 8MB, I suppose. I have a compressed Linux OS in that flash.
> Since I have a little resource, I can allocate only 1MB for snort binary,
> though some space will be provided for snort running also.
>
> From the version snort-inline-2.6.1.5 I got the binary of size 2.9MB. Please
> suggest some way to compress it as much as possible, I dont want any
> advanced pre-processors or modules. Just a basic working snort is
> sufficient.
>
> Thanks,
> Ashok SV
>
> ***********************  Aricent-Unclassified   ***********************
> "DISCLAIMER: This message is proprietary to Aricent and is intended solely
> for the use of
> the individual to whom it is addressed. It may contain
> privileged or confidential information and should not be
> circulated or used
> for any purpose other than for what it is intended. If you have received
> this message in error,
> please notify the originator immediately. If you are
> not the intended recipient, you are notified that you are
> strictly
> prohibited from using, copying, altering, or disclosing the
> contents of this message. Aricent accepts no responsibility for
> loss or
> damage arising from the use of the information transmitted by this email
> including damage from virus."
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>

Re: [Snort-inline-users] Snort installation on a Modem

[Jason <sec...@br...>]

in that space and with those constraints you are probably better off 
going with ngrep.

Will Metcalf wrote:
> Errrr where are you going to load your rules if there is no RAM?
> 
> On Fri, Feb 29, 2008 at 6:45 AM,  <Ash...@ar...> wrote:
>> Hi,
>>
>> I would like to install snort-inline on a modem that has typically 8MB
>> flash. There will be no RAM in a modem. Execution space will be shared
>> within that 8MB, I suppose. I have a compressed Linux OS in that flash.
>> Since I have a little resource, I can allocate only 1MB for snort binary,
>> though some space will be provided for snort running also.
>>
>> From the version snort-inline-2.6.1.5 I got the binary of size 2.9MB. Please
>> suggest some way to compress it as much as possible, I dont want any
>> advanced pre-processors or modules. Just a basic working snort is
>> sufficient.
>>
>> Thanks,
>> Ashok SV
>>
>> ***********************  Aricent-Unclassified   ***********************
>> "DISCLAIMER: This message is proprietary to Aricent and is intended solely
>> for the use of
>> the individual to whom it is addressed. It may contain
>> privileged or confidential information and should not be
>> circulated or used
>> for any purpose other than for what it is intended. If you have received
>> this message in error,
>> please notify the originator immediately. If you are
>> not the intended recipient, you are notified that you are
>> strictly
>> prohibited from using, copying, altering, or disclosing the
>> contents of this message. Aricent accepts no responsibility for
>> loss or
>> damage arising from the use of the information transmitted by this email
>> including damage from virus."
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft
>> Defy all challenges. Microsoft(R) Visual Studio 2008.
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
>>
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>