Subject: Machine Identity

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 26 Feb 2008 14:05:27 +0100

Sorry to (ab)use the patience of fellow IETFers but I'm puzzled for a
long time by an apparent gap in Internet protocols: there is no
standard of identity for machines on the Internet. 

I recently read a report about a P2P program which was difficult to
port to IPv6 because it used the IP address as the machine identity
and it was a problem to have several addresses (such as one in v4 and
one in v6).

The problem is that there is no obvious way to find the identity of
the machine. P2P programs typically require it because they base
things like reputation on it. Such an identity should be unique and
provable.

There are solutions for some protocols (SSH keys of RFC 4251 or Host
Identifiers of HIP in RFC 4423 are two good examples) but no general
"identity layer" in the Internet architecture.

Did I miss something? Is there work on it somwhere?

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 26 Feb 2008 14:11:55 +0100

Stephane Bortzmeyer wrote:
[..]
> "identity layer" in the Internet architecture.

IMHO HIP (RFC4423) is that exact identity layer and additionally solves 
a number of other issues that it was made for.

The big problem though is that actually getting programs to use this is 
cumbersome, simply because a lot of programmers don't know about it.

Same goes for the use of SRV records, IMHO, instead of point to AAAA/A 
records for a service, one should *always* use SRV records.

SRV records solve loadbalancing, failover and a lot of other issues 
mostly already in DNS.

Webbrowsers for instance don't do SRV yet. One of their arguments is 
'lookup time', the same reason that some 'webdevelopers' used IP 
addresses in their websites as that would skip the resolving step...

This is more about educating programmers than anything else...

Greets,
  Jeroen

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 26 Feb 2008 15:27:54 +0100

On Tue, Feb 26, 2008 at 02:11:55PM +0100,
 Jeroen Massar <[email-masked]> wrote 
 a message of 47 lines which said:

> IMHO HIP (RFC4423) is that exact identity layer 

I feel the same way but it does not seem that HIP interests many
people?

> The big problem though is that actually getting programs to use this
> is cumbersome, simply because a lot of programmers don't know about
> it.

Via draft-ietf-hip-native-api? How many implementation? How could I
use it on a machine which has no HIP in its kernel?

---

From: der Mouse <[email-masked]>
Date: Tue, 26 Feb 2008 10:41:41 -0500 (EST)

> [...]: there is no standard of identity for machines on the Internet.

> Such an identity should be unique and provable.

This is extremely hard to do, since the machine is represented only by
the software running on it, and that can present any identity it
chooses, unique or not.

This could be "solved" by something like public-key crypto in hardware,
but (a) there's no way to prevent a software implementation short of
something like a PKI signer who signs only stored-in-hardware keys
(which has a whole raft of problems of its own) and (b) a hardware
version has a pile of problems of _its_ own, starting with installed
base and end-user resistance.  (I know *I* certainly wouldn't use such
a thing.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 26 Feb 2008 17:04:12 +0100

On Tue, Feb 26, 2008 at 10:41:41AM -0500,
 der Mouse <[email-masked]> wrote 
 a message of 20 lines which said:

> This is extremely hard to do,

OK, let me rewrite it in a more realistic way.

Such an identity should be almost unique (as is a number choosen at
random in a very large space) and the machine should be able to prove
that it indeed "owns" this identity (as is an ID which is the public
part of a cryptographic key).

For me, SSH keys or HIP Host Identifiers fulfill these requirments.

---

From: Keith Moore <[email-masked]>
Date: Tue, 26 Feb 2008 11:24:04 -0500

> cumbersome, simply because a lot of programmers don't know about it.

I like HIP.  But if there is any OS that ships with HIP support, I 
haven't heard about it.  And as soon as we get a "machine identity" I 
suspect we'll realize that what people want to identify isn't exactly a 
"machine" anymore.

> records for a service, one should *always* use SRV records.

NO.  SRV records can only be used with applications that are specified 
to use SRV records - otherwise you'll break compatibility with legacy 
applications.  And there are very few of these.

> SRV records solve loadbalancing, failover and a lot of other issues 

Yeah, and they create a tussle between DNS operators and users.

> This is more about educating programmers than anything else...

Seems like IETFers need education at least as much as programmers do...

Keith

---

From: der Mouse <[email-masked]>
Date: Tue, 26 Feb 2008 12:50:50 -0500 (EST)

> For me, SSH keys or HIP Host Identifiers fulfill these requirments.

Then you have a relatively loose definition of "owns", because an SSH
identity demonstrates merely that the host has the cooperation of
someone who owns the identity.  Furthermore, there may be multiple
machines that own the identity in the sense of having the private data,
since the private data can be copied between machines.

That may be fine for your purposes, but there are people, such as DRM
wonks, to whom either of those two properties ("has the cooperation
of", and copyability) is unacceptable.  As someone remarked upthread,
get host identities and you'll find that lots of people actually want
something slightly different from host identities (no matter what value
of "host identities" it is you get).

Of course, for on-the-wire purposes, you can't prove more than "has the
cooperation of" no matter what you do; all you can demonstrate is that
some entity able to act as the other end of that packet stream you're
seeing has the identity in question.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Dave Crocker <[email-masked]>
Date: Tue, 26 Feb 2008 10:37:06 -0800

I feel obligated to ask an obvious question:

    Why isn't a Domain Name sufficient to the purpose you have in mind?

While there are arguments that it is inapplicable for some scenarios, this does 
not apply to all scenarios.  So what are the details of the usage you have in 
mind that render a Domain Name useless?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Keith Moore <[email-masked]>
Date: Tue, 26 Feb 2008 13:50:43 -0500

>    Why isn't a Domain Name sufficient to the purpose you have in mind?

the usual reason is that there's a disconnect between the domain name 
and the host or the app.  the host owner doesn't control the DNS zone 
for his host.  instead, it's under the control of a network admin 
somewhere.  this leads to any number of failures, e.g.  there is no 
stable name that is bound to the host, or the name-to-address bindings 
can't be maintained in an up-to-date fashion.

Keith

---

From: Dave Crocker <[email-masked]>
Date: Tue, 26 Feb 2008 11:24:37 -0800

> can't be maintained in an up-to-date fashion.

That implies a considerable number of assertions about the alternative that were 
not stated.

This realm is marked by massive leaps of unstated requirements faith, ten which 
  to result in talking past each other.

That's why I asked Stephane to clarify exactly what requirements he is trying to 
satisfy.

The rest of us would merely be guessing.

d/

-- 

   Dave Crocker

---

From: Keith Moore <[email-masked]>
Date: Tue, 26 Feb 2008 14:28:40 -0500

Dave Crocker wrote:
> That implies a considerable number of assertions about the alternative 
> that were not stated.
> 
> This realm is marked by massive leaps of unstated requirements faith, 
> ten which  to result in talking past each other.
> 
> That's why I asked Stephane to clarify exactly what requirements he is 
> trying to satisfy.
> 

well, I generally think that IETF exists to solve general problems, 
rather than an individual's specific problems.

Keith

---

From: Dave Crocker <[email-masked]>
Date: Tue, 26 Feb 2008 11:53:24 -0800

Keith Moore wrote:
> and the host or the app.  

That was not a major reason that was cited during the extended period of debate 
about identifier/locator separation design issues.

But to repeat:  Only Stephane knows exactly what he has in mind.

d/
-- 

   Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Tue, 26 Feb 2008 11:59:54 -0800

> For me, SSH keys or HIP Host Identifiers fulfill these requirments.

Apologies.  My query about your requirements was sent before receiving your 
later note.

You are talking about an identifier that is used only during a session, since 
the statistical aspect of uniqueness wouldn't be acceptable for a persistent 
identifier.

Let me modify my query.  Rather than asking about your requirements, I'll ask 
about the uses you have in mind.

For example, identity-based initial rendezvous requires a persistent, unique 
identifier that is globally obtainable.  Re-establishing a session well might not.

Simplistically, an identifier that is used between sessions seems to need to be 
globally registered, unique, and obtainable.  An identifier used within a 
session can be transient, private and statistical.

So can you describe particular scenarios you have in mind, where the identifier 
is used?

d/
-- 

   Dave Crocker

---

From: Keith Moore <[email-masked]>
Date: Tue, 26 Feb 2008 15:35:15 -0500

> That was not a major reason that was cited during the extended period of 
> debate about identifier/locator separation design issues.

Well I certainly brought it up, multiple times, during the NSRG discussions.

> But to repeat:  Only Stephane knows exactly what he has in mind.

And I'm curious to know that as well.  I just don't think we have to 
confine our discussion here to what Stephane has in mind.

---

From: Miika Komu <[email-masked]>
Date: Wed, 27 Feb 2008 00:28:40 +0200 (EET)

On Tue, 26 Feb 2008, Stephane Bortzmeyer wrote:

Hi,

> I feel the same way but it does not seem that HIP interests many

_o/

> use it on a machine which has no HIP in its kernel?

Yes, the native API is an explicit way of using HIP:

http://www.ietf.org/internet-drafts/draft-ietf-hip-native-api-04.txt

Fortunately, also legacy applications can also use HIP:

http://www.ietf.org/internet-drafts/draft-ietf-hip-applications-02.txt

While waiting for changes to libc, the DNS interaction can be accomplished 
by running a DNS proxy in the localhost that can do the HIP magic. The 
kernel support for the new beet mode is not mandatory because it can be 
implemented in userspace using tun/tap devices like OpenHIP does it 
already. Our project (InfraHIP) has contributed already the kernel patches 
to the Linux kernel and half of them have been accepted.

-- 
Miika Komu                                       http://www.iki.fi/miika/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Feb 2008 12:23:18 +0100

On Tue, Feb 26, 2008 at 02:05:27PM +0100,
 Stephane Bortzmeyer <[email-masked]> wrote 

> "identity layer" in the Internet architecture.

An example of an Use Case is given by IKE (RFC 4306). Section 3.5
lists several possible identities for a machine, and there is not a
clear unique way to define this identity (identities like ID_IPV4_ADDR
are typically a poor way to define a machine on the network).

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 28 Feb 2008 12:46:56 +0100

> are typically a poor way to define a machine on the network).

After several years in network management (where the first thing you
like to have are stable unique identities), I have come to the
conclusion that it is hopeless to search for such a generally useful
identity.  What works is all very much dependent on the purpose and
the specific situation, as others have pointed out before.

And even if someone manages to come up with a good solution, people
sooner or later will try to circumvent it since in several situations
it is a feature and not a bug to be able to do dirty things with
identities.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Miika Komu <[email-masked]>
Date: Thu, 28 Feb 2008 14:12:56 +0200 (EET)

> it is a feature and not a bug to be able to do dirty things with

Hi Juergen,

sorry, but I disagree with your opinion. Please give some pointers to 
publications that back up your conclusion.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 28 Feb 2008 13:40:38 +0100

> publications that back up your conclusion.

I don't know what you disagree with. 

- If it is my statement that it is hard to find a stable unique
  identifier that is generically useful, then simply proof me wrong
  by example.

- If it is my statement that people will find reasons to muddle around
  with the uniqueness and stability property of whatever identifer you
  invent? I guess this is hard to proof so lets call it a hypothesis.

/js

---

From: Balazs Lengyel <[email-masked]>
Date: Thu, 28 Feb 2008 14:13:35 +0100

IMHO virtualization, and programs like VmWare are one example where it is hard to say what are 
you trying to identify. The physical box or the virtual machine?
Balazs

---

From: Miika Komu <[email-masked]>
Date: Thu, 28 Feb 2008 15:45:27 +0200 (EET)

Hi,

sorry, I misread the email first time. I agree that there is no single 
identity that suites all environments on all layers of the stack.

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 28 Feb 2008 14:41:22 +0100

Balazs Lengyel wrote:
> IMHO virtualization, and programs like VmWare are one example where it 
> is hard to say what are you trying to identify. The physical box or the 
> virtual machine?

One should identify the *service*

That solves all the issues mentioned here.

The service could be "your p2p app" but also "HTTP host a.example.com" 
or "HTTP host b.example.com" etc.

SSH Keys are a good example of this, they identify the SSH service. You 
can find that service on IPv4 port 22 and IPv6 port 22, maybe on 
different other IP addresses or other port numbers. Everytime you 
connect to that service, you can communicate with it using the same 
public key, as it's private key remains the same. Now if another SSH 
service steals the IP address or port number, you will get a different 
key to talk with.

Solving this with HIP, but instead of "Host" making it "Service" based 
would be great.

Note that a lot of virtualization is service based, not really host 
based. For that matter, the larger sites actually only care about 
services: deploy 1000 HTTP proxies for site X, deploy 1000 crawler bots 
for purpose Z etc. They really can't care less about the host itself, 
that is just a place where the service runs.

Greets,
  Jeroen

---

From: "David Harrington" <[email-masked]>
Date: Thu, 28 Feb 2008 09:02:40 -0500

I don't think that works very well.

We can identify the SNMP service, but there might be multiple SNMP
agents running on a device. And since different OSes have different
ideas of processes, it can be difficult to identify different
instances of the same service. (We tried to standardize facility in
the syslog WG, and couldn't come up with a standard across operating
systems.)

In SNMPv3, we developed an identifier to identify each engine, but
users actually prefer to model the network topology using the IP
address, because when dealing with topology maps the purpose is to
manage the devices in the network. 

If a device catches fire, you don't want to search through diagrams of
virtual services; you want to know where the device is so you can put
the fire out. ;-)

As Juergen said, which identifier works best depends on what you are
trying to do, and no single identifier will always be the best choice.

David Harrington
[email-masked]
[email-masked]
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Jeroen Massar
> Sent: Thursday, February 28, 2008 8:41 AM
> To: Balazs Lengyel
> Cc: [email-masked]
> Subject: Service Identity (Re: Machine Identity)
> 
> Balazs Lengyel wrote:

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 28 Feb 2008 15:55:32 +0100

> manage the devices in the network. 

With this whole identity stuff, people have to change their thinking and 
start thinking outside the box (buzzzzzzzzzzzzzzzzz-word :)

IP is great for talking from A to B. Once A and B where hosts, now they 
generally are virtual hosts, or even only a service.

As such the "IP" here is a reasonable ID, as it represents the service.

> trying to do, and no single identifier will always be the best choice.

It always depends on what you want to do, I fully agree, but for your 
example the "SNMP service" you will be looking at are 2 services:

  - cpu load, memory usage etc, on the virtual device
    => this is "SNMP service on vhost X"

  - temperature, harddisk status etc on the physical host
    => this is "SNMP service on physical host Y"

Those are two different services, not one, but two, and probably more.

Most very likely vhost X has a different IP from host Y, thus using IP's 
here is one way to go. The problem comes when the IP changes, your 
service is still the same, but you based your ID on something which is 
not a stable identifier.

This is of course also all a similar problem with Multihoming and 
Mobility etc. One day you are IP X the other moment you are IP Z.

The real way to solve this is the Identity layer, and HIP provides just 
that.

Greets,
  Jeroen

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Feb 2008 16:20:30 +0100

On Thu, Feb 28, 2008 at 02:13:35PM +0100,
 Balazs Lengyel <[email-masked]> wrote 
 a message of 10 lines which said:

> what are you trying to identify. The physical box or the virtual
> machine?

The Unit of Management. It is here the virtual machine but, in other
cases, it may be a cluster of tightly cooperating machines.

---

From: Dave Crocker <[email-masked]>
Date: Thu, 28 Feb 2008 08:01:18 -0800

> are typically a poor way to define a machine on the network).

What I found was:

      "used for policy lookup... may be used by an
    implementation to perform access control decisions"

That means that the identifier must be persistent and public, I believe.  It's 
unlikely that a statistically rare (rather than unique) identifier would be 
acceptable for this.  That means a uniqueness registration process is required.

Domain names satisfy these requirements.

So what's wrong with using them for the applications you have in mind?

d/
-- 

   Dave Crocker

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 28 Feb 2008 17:04:22 +0100

On Thu, Feb 28, 2008 at 03:55:32PM +0100, Jeroen Massar wrote:

> here is one way to go. The problem comes when the IP changes, your service 
> is still the same, but you based your ID on something which is not a stable 
> identifier.
>
> This is of course also all a similar problem with Multihoming and Mobility 
> etc. One day you are IP X the other moment you are IP Z.
>

Some 10+ years ago, SNMP decoupled the identity of an SNMP service
from the transport used to access the service by introducing the
notion of an engineID. It was architecturally the right thing to
do. At that time, people hoped that management applications would at
start using engineIDs since they are architecturally the right thing
to deal with proxies, NATs and all sort of issues. Ten years later, we
must simply observe that this did not happen. Perhaps HIP as a more
general solution to this problem has more luck.

/js

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Feb 2008 17:23:04 +0100

On Wed, Feb 27, 2008 at 12:28:40AM +0200,
 Miika Komu <[email-masked]> wrote 
 a message of 39 lines which said:

> While waiting for changes to libc, the DNS interaction can be
> accomplished by running a DNS proxy in the localhost that can do the
> HIP magic.

Hold on, I did not want to actually use the HIP protocol. I was just
thinking aloud about wether it was possible to use Host Identities in
an ordinary application (regardless of wether HIP was running or not).

For instance, suppose we were redesigning SSH from scratch, would it
be possible / would it make sense to use Host Identities instead of
SSH-specific keys?

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Feb 2008 17:34:23 +0100

On Tue, Feb 26, 2008 at 11:59:54AM -0800,
 Dave Crocker <[email-masked]> wrote 
 a message of 37 lines which said:

> Rather than asking about your requirements, I'll ask about the uses
> you have in mind.

My original thinking was about a P2P system. Entities (I could have
used the term "machines" but it seems to mislead people in physical
machines only) request things (for instance, files) from other
entities and give things to others. In doing so, they build a
reputation ("leecher" or "nice guy"). This reputation is tied to their
identity. Hence the desire to have an identity which is not too
transient (IP addresses are not stable over time and a machine can
legitimately have several, for instance one v4 and one v6).

Of course, an entity must not be able to take the identity of another
one, for instance to steal its reputation. Hence the need for
authentication.

On the other hand, being able to generate a lot of identities is not a
problem: an entity which would do so would start at a reputation of
zero, which is not its interest.

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 28 Feb 2008 17:38:46 +0100

> zero, which is not its interest.

Trust..... OpenPGP ? :)

I always like to point to www.advogato.org/trust-metric.html in these cases.

As such, SSH-keys, HIP and OpenPGP are items you can use already for 
this, the latter already has trust built in thus seems suitable for your 
use.

Greets,
  Jeroen

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 28 Feb 2008 17:40:45 +0100

Juergen Schoenwaelder wrote:
[..]
> general solution to this problem has more luck.

I don't think that programs are going to adopt this, simply because the 
programmers don't know about it and because there is no easy way to have 
it available on the platforms they want to program for. If there was a 
simple API for this which worked on all platforms and had a BSD license 
+ commercial licenses if needed then it would help quite a bit, still 
though changing people, hard thing.

I would love to, but unfortunately I don't see it happening.

Greets,
  Jeroen

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 28 Feb 2008 17:41:31 +0100

On Tue, Feb 26, 2008 at 10:37:06AM -0800,
 Dave Crocker <[email-masked]> wrote 

>    Why isn't a Domain Name sufficient to the purpose you have in mind?

I agree with the reasons given by Keith Moore (a machine does not
control its domain name).

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 28 Feb 2008 17:51:32 +0100

> control its domain name).

More importantly: the service can't be anonymous then.

Greets,
  Jeroen

---

From: Miika Komu <[email-masked]>
Date: Thu, 28 Feb 2008 18:53:22 +0200 (EET)

> an ordinary application (regardless of wether HIP was running or not).

A research proposal called "Unmanaged Internet Protocol" does something 
like this:

http://www.pdos.lcs.mit.edu/papers/uia:osdi06.pdf

The "personal identitities" of UIA are really just an extension of Host 
Identities as experiments in another previous year publication indicate:

http://www.iki.fi/miika/docs/f17-komu.pdf

> be possible / would it make sense to use Host Identities instead of

IMHO yes.

---

From: Dave Crocker <[email-masked]>
Date: Thu, 28 Feb 2008 09:32:52 -0800

> control its domain name).

      The requirements you have provided mean that there must be a global, 
persistent registration service.

      As you go through the effort of specifying a new global registration 
service, make sure to deal with the obvious questions:

1.  What makes the proposed mechanism superior to the DNS registration service?

2,  What is the basis for believing that the proposed service will overcome the 
massive barriers to adoption that have, so far, plagued most proposals for 
adding to the Internet's infrastructure services?

d/
-- 

   Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Thu, 28 Feb 2008 09:36:18 -0800

Jeroen Massar wrote:
>>  Dave Crocker <[email-masked]> wrote  a message of 31 lines which said:
>>

1. The stateed use is for application of policies, such as access control.  How 
can that be done in the face of anonymity?

2. In other words, please specify the details of anonymity that you require.

3. Please look at:

    <http://dkim.org/specs/draft-ietf-dkim-overview-09.html>

specifically sections 3.1.5,

d/
-- 

   Dave Crocker

---

From: "Frank Ellermann" <[email-masked]>
Date: Thu, 28 Feb 2008 18:45:37 +0100

> I don't know what you disagree with. 

Indeed.

> If it is my statement that people will find reasons to muddle around

Maybe RFC 4122 (UUID) supports your hypothesis.   

 Frank

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 28 Feb 2008 18:52:19 +0100

Dave Crocker wrote:
> 1. The stateed use is for application of policies, such as access 
> control.  How can that be done in the face of anonymity?

Anonymity in that nothing is registered and can't directly be correlated 
to a certain person (of course you can track IP addresses and use that 
etc to look in other log files etc).

If you take for instance an SSH key. This SSH key 'proves' that the SSH 
service that has the private key, is the same one as the one you talked 
to last time. Still it is quite anonymous, as you don't have any hooks 
to domain names or other details where whois comes into play.

> 2. In other words, please specify the details of anonymity that you 

Nothing is truly anonymous, ever. If somebody wants to find out who you 
are they will find out, if you like it or not.

> specifically sections 3.1.5,

That is what I meant with 1)

DKIM indeed 'comes up' with a pub/priv keypair out of thin air, like 
SSH. When you talk to the host again you do know that you are talking to 
the same host and not a different one, but they are still anonymous.

Greets,
  Jeroen

---

From: der Mouse <[email-masked]>
Date: Thu, 28 Feb 2008 14:55:42 -0500 (EST)

> one, for instance to steal its reputation.  Hence the need for

That's extremely hard, unless you add "...without the cooperation of
the entity whose identity is being copied" to the end of the first
sentence.

> On the other hand, being able to generate a lot of identities is not
> a problem: an entity which would do so would start at a reputation of

It is if that entity's own reputation is negative.  This, for example,
is why spammers register throwaway domains.  In your P2P example, think
serious leechers.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Dave Crocker <[email-masked]>
Date: Thu, 28 Feb 2008 12:52:27 -0800

Jeroen Massar wrote:
>> is hard to say what are you trying to identify. The physical box or 
>> the virtual machine?
> 

Clearly there are cases where it is, in fact, a physical machine that is of 
interest.  But your point is quite well taken.  Most scenarios care about an 
abstraction, not something physical.

Whether that is a logical process, a logical application, a logical host, or an 
"organization" becomes the question.

d/
-- 

   Dave Crocker