Subject: RE: COPS vs. SNMP

From: "Durham, David" <[email-masked]>
Date: Mon, 25 Feb 2002 10:31:53 -0800

I'm interested in what the industry adoption of SNMPConf is/will be.
Particularly given that CERT is already advising that administrators TURN
SNMP OFF! Eg. SNMP is currently undergoing a maelstrom of CERT advisories
and other bad press due to its
troubling susceptibilities. Now just imagine allowing people to actually
download viruses and worms via SNMPConf PM MIB's Scripts.
-Dave

http://www.internetwk.com/story/INW20020213S0002

> -----Original Message-----
> From: Tricha Anjali [mailto:[email-masked]]
> Sent: Monday, February 25, 2002 9:38 AM
> To: [email-masked]
> Cc: Ian F. Akyildiz
> Subject: COPS vs. SNMP
> 
> 
> 
> Hello,
> 
> We have been following the IETF activities concerning the 
> ongoing work in
> the fields of SNMP and COPS. It seems that at the meeting in 
> March 2000 in
> Adelaide, the snmpconf working group was formed for issues 
> dealing with
> policy-based network management after the BOF about network 
> management in
> Dec 1999. However, now the group seems to have accomplished 
> its charter
> and finished. Does this mean that the discussion has been resolved?
> 
> We would like to know if the resource reservation in a 
> network can/should
> be achieved via COPS? If yes, how is it advantageous over SNMP?
> 
> Any help will be appreciated!
> 
> Thanks in advance,
> 
> Tricha
> 
> -------------------------------
> Tricha Anjali
> Broadband & Wireless Networking Lab
> School of Electrical and Computer Engineering
> Georgia Institute of Technology
> http://users.ece.gatech.edu/~tricha/
> 
> 
> 
>

---

From: David Partain <[email-masked]>
Date: Tue, 26 Feb 2002 12:45:26 +0100

Hi all,

> I'm interested in what the industry adoption of SNMPConf is/will be.

As co-chair of SNMPCONF, so am I :-)

> troubling susceptibilities.

I'm very surprised that you would use FUD as a tool for pushing
COPS-PR.  Whether you like SNMP or not, using buffer overflow
problems in (some) SNMP agent implementations to do so seems
pretty ridiculous.

To set the record straight:

  - CERT didn't anything about the SNMP protocol

    That being said, there is NO ONE who thinks that SNMPv1 or
    SNMPv2c is secure.  The SNMP community is/has been pushing
    SNMPv3, which is on the brink of being Standard.

  - What CERT _did_ issue was an advisory about various security
    vulnerabilities in some SNMP implementations.  These
    vulnerabilities were brought to light by a group of
    researchers in Finland who created a set of test tools which
    send pretty whacked-out SNMP packets.  In some cases, the
    agents went belly-up when they got the packets.  In some
    cases, there is a risk that the agent will scribble on memory
    that it shouldn't.  Read the advisory (see below).

    There's no one saying that this is not a problem, but it's
    nothing more than Yet Another Buffer Overflow security
    problem.

To the best of my knowledge, no one's launched such a set
of tests against the COPS implementations.  Are you saying
that if some of these implementations go belly-up and have
buffer overflow problems that this will mean that COPS is an
inappropriate technology for configuration?

> Now just imagine allowing people to actually

Pardon me, but where in the heck did that come from?  Assuming
secure authentication using SNMPv3 (which everyone is), in what
way do you mean that SNMPCONF would be enabling the spread of
viruses and worms?

> http://www.internetwk.com/story/INW20020213S0002

This, and many other articles in the press, just don't Get It.
They say "vulnerabilities that have been discovered in the
Simple Network Management Protocol (SNMP)", which is just wrong.

May I suggest that those who want to understand
should look at the CERT advisory instead of reading
incorrect interpretations by the press.  The advisory is at
http://www.cert.org/advisories/CA-2002-03.html and plainly says,
"Multiple Vulnerabilities in Many Implementations of the Simple
Network Management Protocol (SNMP)".  It says absolutely nothing
about "vulnerabilities ... in SNMP".  You'll also note that it
specifically talks about SNMPv1.

Now, back to your favorite "my protocol is prettier than your
protocol" discussion.

Cheers,

dlp