Subject: [mile] Feedack on 5070bis

From: "Roman D. Danyliw" <[email-masked]>
Date: Wed, 25 Mar 2015 13:16:18 +0000

Hello!

I've been remiss in sharing feedback I've received privately on the 5070bis.

(1) If one has 10s/100s of thousands of a particular type of indicator, it is too cumbersome to encode them individually into a particular class.  More desirable would be a means to convey a long list in a single element.
Instead of the following:
<Address type="ipv4-addr">10.1.1.1</Address>
<Address type="ipv4-addr">10.1.1.2</Address>
<Address type="ipv4-addr">10.1.1.3</Address>
<Address type="ipv4-addr">10.1.1.4</Address>
...
Have something like the following
<BulkObservable type="ipv4-addr">
10.1.1.1
10.1.1.2
10.1.1.3
10.1.1.4
...

(2) The Service class can convey a port number.  It would be valuable to convey the observed port number and also an assessment of the actual observed protocol.  For example, how would one represent "I saw traffic on port 8493/tcp but it was HTTP".

(3) The Counter class doesn't allow one to represent peak and average measurements, only actual packet counts.

Roman

---

From: Chris Inacio <[email-masked]>
Date: Wed, 25 Mar 2015 14:54:56 +0000

> On Mar 25, 2015, at 8:16 AM, Roman D. Danyliw <[email-masked]> wrote:
> 
> Hello!
> 
> …

I like this, since this allows service feeds to more easily leverage IODEF.

> (2) The Service class can convey a port number.  It would be valuable to convey the observed port number and also an assessment of the actual observed protocol.  For example, how would one represent "I saw traffic on port 8493/tcp but it was HTTP”.

> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

--
Chris Inacio
[email-masked]