Subject: RE: [Isms] Coming to consensus

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 1 Jul 2005 15:12:36 -0400

>>Based on this quote it would seem to me that to select SSH would imply
>>that SNMP must use TCP transports only. If so, then I personally
advise
>>against the SSH option because our experience is that SNMP behaves
>>poorly using TCP within bandwidth limited environments. Therefore, I
>>prefer SNMP to be able to use UDP.
>
>I am not sure that SNMPoDTLSoUDP will behave any better that SNMPoTCP
>within those limited bandwidth environments.

I find this concern ungrounded.

DTLS adds considerable overhead during the session establishment phase.
After that it's as light-weight, as can be reasonably expected from a
protocol that provides ancryption and authentication. So depending on
whether DTLS is used when a lot of short-lived sessions are created and
destroyed, or when sessions are reasonably long-lived - you'd see it
faring better than TCP, or not.

>Therefore, based on this limited
>information, it appears to me that (D)TLS is a preferable alternative
>when compared to SSH.
>
>--Eric
>
>-----Original Message-----
>From: Tom Petch [mailto:[email-masked]]
>Sent: Friday, July 01, 2005 12:54 AM
>
> >Don't both TLS and SSH require TCP transports while only DTLS can
> >support UDP?
>
>To quote from "draft-ietf-secsh-architecture-22.txt"
>
>"The transport layer will typically be
>       run over a TCP/IP connection, but might also be used on top of
any
>       other reliable data stream."
>
>so SSH does not need everything TCP has to offer, just reliability.  (I
>seem to recall this coming up in other places, that neither UDP nor TCP
>are right for the upper layers, leading protocol designers to cast
>around for something that fits better.)
>
>
>
>_______________________________________________
>Isms mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Kaushik Narayan <[email-masked]>
Date: Fri, 01 Jul 2005 12:48:02 -0700

Hi Uri,

Please find my reply inline.

<snipped>

>faring better than TCP, or not.

That session establishment is what I am concerned about, I think the
assumption is that we would have long lived sessions between managers
and agents to reduce the initial session establishment cost. That could
be problematic since a single manager might be communicating with
10,000 agents on behalf of several users.

That's a lot of state that needs to be maintained on the manager.

regards,
   kaushik!