Re: [Isms] draft-hardaker-isms-dtls-tm-05 submitted - tlstmNotifications

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Mon, Sep 14, 2009 at 10:52:31PM +0200, Jeffrey Hutzelman wrote:
 
> There really isn't such a thing as "_the_ (D)TLS service".  A given host 
> might have any number of services utilizing TLS or DTLS on different ports 
> with different configuration.  It's not multiplexed the way SSH might be, 
> and you wouldn't want to combine management information for them.  Ideally, 
> there'd be some kind of "MIB fragment" describing (D)TLS which could be 
> incorporated into MIB's for various services using those protocols, of 
> which the SNMP DTLS TM is just one.

We implemented SNMP over SSH by linking in an SSH library; we do not
go through an sshd and hence assuming SSH is "multiplexed" is not
always correct. This is all implementation choice. I agree that an SSH
MIB or [D]TLS MIB would have to provide proper indexing so that
multiple concurrent SSH or D[TLS] instances can export data to the
SNMP agent.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>