Subject: RE: IAP/0.4 questions

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 20 Feb 2001 18:33:41 -0500

Ben et. al.;

Maybe more explicit but more descriptive e.g. 'an iap-content-request MAY 
contain multiple IDEMF-Message elements each containing an Alert element. 
 Thus, an iap-content-request message MAY contain more than one alert.'.

However, I am not sure that the indication of "an IDMEF-Message element can 
contain multiple Alert elements" is true.  I do not recall, having re-read the 
draft, the IDEMF-Message Alert element allowing multiple alerts in a message. 
 In fact I think you can have one only per message.  I could be wrong or maybe 
it is not clear to me because of the <tag/> stuff.  Anyway, containing multiple 
IDEMF-Message elements should cover it.

QUESTION: Does this introduce a problem with iap-content-request messages 
containing multiple IDEMF-Message elements of type Alert and IDEMF-Message 
elements of type Heartbeat commingled and introducing Manager overhead issues?

Eric

Eric Williams, Pres.
Information Brokers, Inc.    Phone: +1 202.889.4395
http://www.infobro.com/        Fax: +1 202.889.4396
               mailto:[email-masked]
           For More Info: [email-masked]
                    PGP Public Key
   http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789

On Tuesday, February 20, 2001 4:00 PM, Ben Feinstein 
[SMTP:[email-masked]] wrote:
>
>
> On Tue, 20 Feb 2001, Michael J. Slifcak wrote:
>
> > Referring to the iap-content message :
> >   Does the protocol allow more than one alert to be packaged in
> >     the IDMEF-Message section ?
>
> The protocol should support the exchange of multiple IDMEF-Message
> elements in a single iap-content-request message.  Its not clear to me
> when I reread the draft that we made that explicit anywhere.  My
> understanding is that an IDMEF-Message element can contain multiple Alert
> elements.  So, yes, IAP supports multiple alerts per iap-content-request,
> but we should be more explicit I think.
>
> > Referring to the specification of the cipher suite :
> >   Suggest changing 'ciphersuite' to 'cipher suite'.
> >   Suggest changing '-' to '_' to more closely follow RFC 2595;
> >      Result would be "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA".
>
> Done.
>
>
> Cheers,
>
> Ben Feinstein
> Harvey Mudd College, Computer Science
>

---

From: Ben Feinstein <[email-masked]>
Date: Tue, 20 Feb 2001 16:22:13 -0800 (PST)

> IDEMF-Message elements should cover it.

See Section 5.2.1 of draft-ietf-idwg-idmef-xml-03.txt for a definition of
the "IDMEF-Message Class".  The IDMEF-Message element is declared in the
IDMEF DTD as

<!ELEMENT IDMEF-Message                   (
          (Alert | Heartbeat)*
        )>

meaning that it can contain zero of more Alerts or Heartbeats.

How about this?

'An iap-content-request MAY contain zero or more IDEMF-Message elements.
Each IDMEF element MAY contain zero or more subelements, including
multiple Alert and Heartbeat elements. Thus, an iap-content-request
message MAY contain more than one Alert.'

> elements of type Heartbeat commingled and introducing Manager overhead issues?

Typically, a Manager would be using an IAP library to receive
iap-content-requests.  Any aggregation or sorting of the IAP message
contents is really outside the scope of IAP.  Note that the use of an XML
parser makes the task of aggregating and sorting IDMEF-Messages and Alerts
relatively straightforward for a Manager using IAP.

Cheers,

Ben Feinstein