Subject: [Isms] SNMP SSH ports

From: "David Harrington" <[email-masked]>
Date: Wed, 21 Jan 2009 12:14:02 -0500

one
      for request/response traffic, and one port that listens for
notifications."

Pasi> - Secton 8, "two well-known ports" -- hmm, rest of the document
seems
to assume a single port? (including IANA considerations and several
other places)

I think I should eliminate the sentence in section 8. PLease correct
me if I'm wrong.

David Harrington
[email-masked]
[email-masked]
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 21 Jan 2009 11:50:19 -0800

DH> I think I should eliminate the sentence in section 8. PLease correct
DH> me if I'm wrong.

Well, we can either do one well known port with two different service
names or two well known ports each with the same service name.

Anything with embedded ssh, though, wouldn't want to do two different
service names if they had both a NR and a CR on the same box that wasn't
the same process.

There has to be some way, however, of distinguishing whether you're
trying to get to a NR or CR entity.  Yes, you could do it via the SNMPv3
pdu handler registration process but in reality most software isn't
architected that way.
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 21 Jan 2009 15:11:52 -0500

<[email-masked]> wrote:

>>>>>> On Wed, 21 Jan 2009 12:14:02 -0500, "David Harrington"
>>>>>> <[email-masked]> said:
>

What do you mean by "service name" here?  An SSH subsystem name?

It seems to me that the right answer here is to define distinct ports, not 
distinct subsystem names.  Subsystem names are not intended as a mechanism 
for multiplexing multiple instances of the same subsystem.  We also need to 
recognize that many NR's will run on nonstandard ports; an interactive 
management app is certainly going to want to use a port dynamically 
allocated by its OS.
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 21 Jan 2009 12:34:48 -0800

a DISCUSS from the IESG. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Wes Hardaker
> Sent: Wednesday, January 21, 2009 11:50 AM
> To: David Harrington
> Cc: [email-masked]
> Subject: Re: [Isms] IsmsSNMP SSH ports
> 
> Well, we can either do one well known port with two different 
> service names or two well known ports each with the same service name.
> 
> Anything with embedded ssh, though, wouldn't want to do two 
> different service names if they had both a NR and a CR on the 
> same box that wasn't the same process.
> 
> There has to be some way, however, of distinguishing whether 
> you're trying to get to a NR or CR entity.  Yes, you could do 
> it via the SNMPv3 pdu handler registration process but in 
> reality most software isn't architected that way.
> --
> Wes Hardaker
> Sparta, Inc.

---

From: "David Harrington" <[email-masked]>
Date: Wed, 21 Jan 2009 16:54:46 -0500

> We also need to 
If the notification receiver listens on nonstandard ports, how will
the notification originator know where to send notifications?

SNMP usually uses standard ports 161 (where an agent listens for
requests) and 162 (where a manager listens for notifications). An SNMP
entity can act as both agent and manager. 

The port used to send is often dynamically allocated (and that defines
the port to which to send responses).

dbh

---

From: "David Harrington" <[email-masked]>
Date: Wed, 21 Jan 2009 17:13:31 -0500

multiplex as needed)

dbh 

> From: Joseph Salowey (jsalowey) [mailto:[email-masked]] 
> Sent: Wednesday, January 21, 2009 3:35 PM
> To: Wes Hardaker; David Harrington
> Cc: [email-masked]
> Subject: RE: [Isms] IsmsSNMP SSH ports
> 
> Why do we need port numbers in the range 1..1023?  The is 
> bound to cause
> a DISCUSS from the IESG. 
>

---

From: "David Harrington" <[email-masked]>
Date: Wed, 21 Jan 2009 17:21:59 -0500

I think we need two *registered* ports, and I recommend requesting
5161 and 5162.

dbh 

> Behalf Of David Harrington
> Sent: Wednesday, January 21, 2009 5:14 PM
> To: 'Joseph Salowey (jsalowey)'; 'Wes Hardaker'
> Cc: [email-masked]
> I think all we need is two fixed well-known ports (or one that can
> multiplex as needed)
> 
> dbh 
>

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 21 Jan 2009 14:22:34 -0800

sufficient instead of fixed well-known ports (range 1 through 1023)? 

> From: David Harrington [mailto:[email-masked]] 
> Sent: Wednesday, January 21, 2009 2:14 PM
> To: Joseph Salowey (jsalowey); 'Wes Hardaker'
> Cc: [email-masked]
> I think all we need is two fixed well-known ports (or one 
> that can multiplex as needed)
> 
> dbh 
> 
> > Why do we need port numbers in the range 1..1023?  The is bound to 
> > cause a DISCUSS from the IESG.
> > 
> > > From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> > > Of Wes Hardaker
> > > different service names if they had both a NR and a CR on 
> the same 
> > > box that wasn't the same process.
> > > 
> > > trying to get to a NR or CR entity.  Yes, you could do it via the 
> > > SNMPv3 pdu handler registration process but in reality 
> most software 
> > > isn't architected that way.
> > > --
> > > Wes Hardaker
> > > Sparta, Inc.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 22 Jan 2009 09:01:18 +0100

> I think we need two *registered* ports, and I recommend requesting

This sounds like a good concensus position. WG members should speak up
now if they disagree with this resolution.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 22 Jan 2009 09:03:19 -0800

>> names or two well known ports each with the same service name.

JH> What do you mean by "service name" here?  An SSH subsystem name?

Yep.

JH> It seems to me that the right answer here is to define distinct
JH> ports,

I agree.  I was laying out the options, but I do agree that using
different ports would be better.

---

From: "tom.petch" <[email-masked]>
Date: Mon, 26 Jan 2009 12:11:18 +0100

----- Original Message ----- 
From: "Juergen Schoenwaelder" <[email-masked]>
To: "David Harrington" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, January 22, 2009 9:01 AM
Subject: Re: [Isms] IsmsSNMP SSH ports

> On Wed, Jan 21, 2009 at 05:21:59PM -0500, David Harrington wrote:
> 
Works for me.

I would suggest amending the examples in tsm to match.

Tom Petch