Subject: RE: Portlist [was Re: DTD/Data Model changes (Message 1 of 4)]

From: "Osterwald, Paul" <[email-masked]>
Date: Fri, 19 Jan 2001 20:04:46 -0600

Could this possibly be interpreted as:

<Target> 
             <Node category="dns"> 
               <name>www.bigcompany.com</name> 
               <Address category="ipv4-addr"> 
                 <address>123.234.231.121</address> 
               </Address> 
             </Node> 
             <Service> 
               <dport>5</dport>
		   <dport>6</dport>
		   ... and so on ... 
             </Service> 
 	  </Target>

> Paul Osterwald
> Sr. Security Engineer
> Intrusion.com
> 3940 Ruffin Road
> Suite C
> San Diego, CA  92123
> (858) 268-1236 x2232 (Work)
> (858) 268-7755 (Fax)
> (619) 865-2775 (Cell)
> http://www.intrusion.com
> mailto:[email-masked]
> 
And if this be the last time I go down to the sea once more, I shall always
remember the men who have sailed and served with me.  It has been my honour
and privilege to be with you this day.

To the sea once more for England.  God save the King.

-- Lord Nelson, First Lord of the Admiralty at Trafalger

-----Original Message-----
From: Stuart Staniford [mailto:[email-masked]]
Sent: Monday, January 15, 2001 5:09 PM
To: David A. Curry
Cc: [email-masked]
Subject: Portlist [was Re: DTD/Data Model changes (Message 1 of 4)]

Everything looks great except:

"David A. Curry" wrote:
> 
>  9. The <portlist> element is being removed from the <Service> element.
To
>     achieve lists of ports, specify multiple <Target> elements.

I've given this a little thought, and I'm not sure this is a good change. 
The old definition was  

> 7. Port lists, as used in the <portlist> element, are encoded as a 
>       comma-separated list of numbers (individual integers) and ranges 
>       (N-M means ports N through M, inclusive). Any combination of 
>       numbers and ranges may be used in a single list. For example: 5-
>       25,37,42,43,53,69-119,123-514. 

and an example in the document was

>           <Target> 
>             <Node category="dns"> 
>               <name>www.bigcompany.com</name> 
>               <Address category="ipv4-addr"> 
>                 <address>123.234.231.121</address> 
>               </Address> 
>             </Node> 
>             <Service> 
>               <portlist>5-25,37,42,43,53,69-119,123-514</portlist> 
>             </Service> 
> 	  </Target>

If we get rid of portlist, this will become

           <Target> 
             <Node category="dns"> 
               <name>www.bigcompany.com</name> 
               <Address category="ipv4-addr"> 
                 <address>123.234.231.121</address> 
               </Address> 
             </Node> 
             <Service> 
               <dport>5</dport> 
             </Service> 
 	  </Target>
          <Target> 
             <Node category="dns"> 
               <name>www.bigcompany.com</name> 
               <Address category="ipv4-addr"> 
                 <address>123.234.231.121</address> 
               </Address> 
             </Node> 
             <Service> 
               <dport>6</dport> 
             </Service> 
 	</Target>
          <Target> 
             <Node category="dns"> 
               <name>www.bigcompany.com</name> 
               <Address category="ipv4-addr"> 
                 <address>123.234.231.121</address> 
               </Address> 
             </Node> 
             <Service> 
               <dport>7</dport> 
             </Service> 
 	</Target>

	... continue for another five hundred or so ports ...

Did I misunderstand?

Are you sure that's a good idea?

Stuart.

-- 
Stuart Staniford  ---  President  ---  Silicon Defense
[email-masked]  http://www.silicondefense.com/
(707) 445-4355                     (707) 445-4222 (FAX)

---

From: "Osterwald, Paul" <[email-masked]>
Date: Mon, 22 Jan 2001 14:17:27 -0600

Oops.  I misread.  That might be an interesting manner of doing it however.
I would make more sense and I think would only warrant a minor change to the
DTD.  Someone please correct me if I am wrong.

-----Original Message-----
From: David A. Curry [mailto:[email-masked]]
Sent: Monday, January 22, 2001 5:28 AM
To: Osterwald, Paul
Cc: 'Stuart Staniford'; [email-masked]
Subject: Re: Portlist [was Re: DTD/Data Model changes (Message 1 of 4)] 

[email-masked] wrote:
>    <Address>category="ipv4-addr">

Not in the current data model/DTD; they specify zero or one (not zero or
more)
occurrences of <dport>.  It might make more sense to do this than the
"repeat
the whole Target thing" approach, if we end up keeping other stuff the same,
though.

--Dave