Subject: Re: [tsvwg] [Fwd: Re: AD review: draft-ietf-tsvwg-port-randomization-05]

From: "tom.petch" <[email-masked]>
Date: Fri, 5 Feb 2010 09:28:44 +0100

----- Original Message -----
From: "Michelle Cotton" <[email-masked]>
To: "Fernando Gont" <[email-masked]>; "Lars Eggert"
<[email-masked]>
Cc: "tsvwg" <[email-masked]>
Sent: Monday, February 01, 2010 11:39 PM

Fernando/Lars,

Following-up on the thread below.

Port Number requests are rejected for many reasons.  Here are three of the most
common reasons:

1 - Duplicates a function or protocol already in existence
2 - Is the secure version of a port already applied for or already in existence
3 - Port applied for is of local use only and traffic does not flow over the
public Internet

In general, a port number request is granted when an applicant can show a
well-defined, public Internet protocol.  The port must identify a named service
that allows sessions to be created over the public Internet.  The protocol, in a
successful application, will be sufficiently documented to ensure that it is not
local or a version of another service already in use.

I hope this information helps.  Please let me know if there is anything I can
clarify.

<tp>

Michelle

How straightforward and clear the above paragraphs are.  Honest.  Brilliant.

I need to say this because recently I was critical of
draft-ietf-tsvwg-iana-ports-04
for the lack of just this information, for describing the bureaucracy of port
assignment/allocation/registration/reservation/request/grant........
without
a) explaining what if anything is the difference between these terms
b) describing what the point of the bureaucracy is.

Your paragraphs above do more good than the whole of section 7, so please ditch
section 7, include something along the lines above, and place it right at the
front of the I-D, section 2.  I would place reasons for granting before reasons
for rejecting but otherwise I would change little.

Tom Petch

</tp>

Michelle
IANA

On 1/27/10 11:20 AM, "Fernando Gont" <[email-masked]> wrote:

>> Have there any cases in which use of a port has been rejected?
>
> Yes.
>
>> If so, what has been that reason?
>
> Depends :-) Maybe IANA can give some examples.
>
>> And what has been the criteria for actually "granting" the use of
>> ports (as the above)?
>
> Satisfying the Expert Reviewer.

---

From: Joe Touch <[email-masked]>
Date: Fri, 05 Feb 2010 08:46:33 -0800

Tom,

The problem is that the two ideas (the list below, vs. Sec 7) have
completely different purposes.

Section 7 describe IANA policies and changes therein.

The above describes expert review, which is a separate matter.

I hesitate to encode expert review rules - even the "most common" ones -
because then can too easily change, and putting them in a doc promotes
them as static. Further, this doc is about IANA issues, not the expert
review process.

Joe

---

From: Fernando Gont <[email-masked]>
Date: Fri, 05 Feb 2010 14:00:02 -0300

> them as static. Further, this doc is about IANA issues, not the expert

The question is not about how the expert review is performed, but rather
about if that review is even possible (e.g., for closed protocols).

If that review is not possible, then there's no way to decide on
granting vs. rejecting the ports, and thus IANA is not really assigning
the ports, but rather registering them (registering their use).

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Joe Touch <[email-masked]>
Date: Fri, 05 Feb 2010 09:05:16 -0800

Hi, Fernando,

> about if that review is even possible (e.g., for closed protocols).

First, expert review is advisory only. IANA decides based on that input,
but isn't bound to it.

Second, closed protocols still need to explain something about what they
do, i.e., their basic commands, packet size ranges, support for
versioning, use of congestion control for UDP variants, etc. Specifics
aren't needed to do the review, and applications always contain the
needed info - even for closed protocols.

> the ports, but rather registering them (registering their use).

The above might clarify that point. IANA is assigning, by your distinction.

Joe