This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Any reason not to strip symbols from wireshark/libwireshark/libwiretap?

0

I usually use strip(1) on Unix/Linux systems to strip symbols from executable binaries and libraries, on the general principle that smaller executables = smaller memory footprint = better performance. As long as I'm not debugging/breakpointing the code, there shouldn't be any need for the symbols anyway...

Doing so to the main components of Wireshark 1.10.0 makes a HUGE difference in the size of the executables:

  • wireshark: from 10MB to 2MB
  • libwireshark: from 158MB to 60MB
  • libwiretap: from 1.5MB to 340KB

I've run several tests and haven't noticed any problems - does anyone know of any reason NOT to do this?

asked 25 Jul '13, 18:03

wesmorgan1's gravatar image

wesmorgan1
411101221
accept rate: 4%


One Answer:

3

I usually use strip(1) on Unix/Linux systems to strip symbols from executable binaries and libraries, on the general principle that smaller executables = smaller memory footprint = better performance.

"Smaller executables" does not imply "smaller memory footprint". Not everything in an executable image ends up in the address space of the process running the executable; the code and data sections do, but the symbol table does not - it's in the file, but not in memory.

Stripping executable images will have only a minimal effect on performance, if it has any effect at all. The only harm it would cause would be if the program were to crash and, in order to try to debug the crash and get the problem fixed, the supplier of the program needed something such as a stack trace of the crash; if the symbols aren't present, the stack trace wouldn't be able to indicate what functions in the program were being called, it would only give the addresses of the functions, not their names.

Unless you have a need to save disk space, don't bother stripping the executables.

answered 26 Jul '13, 01:23

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Weird...top(1) seems to indicate reduced memory consumption (in terms of system totals) after stripping. (I know that symbols aren't loaded by default.) I did notice a definite imporovement in launch time. Since I wasn't running it in a debugging environment, I just assumed that some internal debugging code was loading them. I'll go back and take a more detailed look, since I've obviously missed something. Thanks for the clarification.

(26 Jul '13, 08:49) wesmorgan1