Subject: comments on <draft-ietf-disman-remops-mib-04.txt> part 3

From: Randy Presuhn <[email-masked]>
Date: Wed, 12 May 1999 17:31:45 -0700 (PDT)

Hi -

Comments on <draft-ietf-disman-remops-mib-04.txt>, pages 42..50

General comment:

It looks to me like the lookup MIB needs to be split into
separate request and result tables, like the other two mibs,
in order to deal with multi-homed hosts and other such goodies.

=============
Page 42:

|          FROM SNMPv2-SMI                  -- RFC1902
                                                  2578

|          FROM SNMPv2-TC                   -- RFC1903
                                                  2579

|          FROM SNMPv2-CONF                 -- RFC1904
                                                  2580

|          FROM SNMP-FRAMEWORK-MIB          -- RFC2271
                                                  2571

|      ::= { experimental 84 3 }

Add comment to IANA to get assignment.

|   lookupMaxConcurrentRequests OBJECT-TYPE
|      SYNTAX      Integer32 (1..100)

units?  This limit is not architectural; I'd prefer limiting the
upper bound only by the underlying data type.  Would setting
this to 0 provide a way to turn the thing off?

============
Page 43:

|   lookupEntry OBJECT-TYPE
|      SYNTAX      LookupEntry
|      MAX-ACCESS  not-accessible
|      STATUS      current
|      DESCRIPTION
|          "Defines an entry in the lookupTable."
|      INDEX {
|               lookupOwnerIndex,
|               lookupOperationName,
|               lookupAddressType,
|               lookupAddress
|            }
|      ::= { lookupTable 1 }

Suggest adding text to the description describing the rationale for
this indexing scheme.

============
Page 44:

|         All entries in that table belonging to a particular user will

Same comment as for similar text in ping and traceroute mibs.

|   lookupTime OBJECT-TYPE
|      SYNTAX      Unsigned32
|      UNITS       "seconds"
|      MAX-ACCESS  read-only
|      STATUS      current
|      DESCRIPTION
|          "Reports the number of seconds that a lookup
|          operation required to be completed at a remote host.
|          Completed means operation failure as well as
|          success."
|      ::= { lookupEntry 8 }

This implies that the entry does not come into being until the
operation terminates.  We need to define an "in-progress" value, 
like zero.

It would be nice to have this time available in greater precision than
seconds.

==============
Page 44:
|   lookupRc OBJECT-TYPE
|      SYNTAX      Unsigned32
|      MAX-ACCESS  read-only
|      STATUS      current
|      DESCRIPTION
|          "The system specific return code from a lookup
|          operation.  All implementations must return a value
|          of 0 for this object when the remote lookup
|          operation succeeds.  A non-zero value for this
|          objects indicates failure.  It is recommended that
|          implementations that support errno use it as the
|          value of this object to aid a management
|          application in determining the cause of failure."
|      ::= { lookupEntry 9 }

How does a management application know what meanings to assign
to a non-zero value?

========
Page 45:

|   lookupResultType OBJECT-TYPE
...
|   lookupResult OBJECT-TYPE
...

What happens when there are multiple results?  E.g., a multi-homed
host?

=========
Page 46:

|   lookupRowStatus OBJECT-TYPE

what objects are necessary to go active?

|          A remote DNS Lookup operation is started when an

We need to be crystal clear on whether we're exercising DNS
or the remote hosts resolver, which may or may not rely on
DNS.  Whether we're operating at the "gethostbyname()" or
the DNS level makes a BIG difference in some environments.

=================
Page 48:

|5.0  Security Considerations
...

The current text here is weak: authentication isn't enough; this MIB
cries out for the use of access control.  Suggest strengthening
this section to resemble those from the script or schedule mibs,
since some of the same issues arrise here.

In addition, the text should note that ping and traceroute are
possible attack vehicles.  (Payload pattern sensitivity might
be another.)

===============
Page 48-49:

References need updating.

===================
Page 50:

|Copyright (C) The Internet Society (1997).  All Rights Reserved.
                                        9

 -----------------------------------------------------------------------
 Randy Presuhn           [email-masked]     http://www.bmc.com
 Voice: +1 408 616-3100  BMC Software, Inc.           965 Stewart Drive
 Fax:   +1 408 616-3101  Sunnyvale, California 94086  USA
 -----------------------------------------------------------------------
 Any relationship between my opinions and BMC's is coincidental.
 -----------------------------------------------------------------------

---

From: [email-masked]
Date: Mon, 31 May 1999 05:56:07 -0400

Hi,

>in order to deal with multi-homed hosts and other such goodies.

I have created a results table but have not created a history
table since I don't think it is needed.

>this to 0 provide a way to turn the thing off?

As with the others I have removed the range and changed the syntax
to Unsigned32. I have added text that states a value of 0 disables
the function. I will add a "requests" UNIT
clause.  I have done this in all three MIBs.

>Suggest adding text to the description describing the rationale for

OK. I have done this in all three MIBs for all entry definitions.

>Page 44:
>      All entries in that table belonging to a particular user will

>Same comment as for similar text in ping and traceroute mibs.

Same answer as before.  Change made in all three MIBs.

>It would be nice to have this time available in greater precision than

Changed to milliseconds.

>How does a management application know what meanings to assign

This is probably another answer you won't like.  I expect that
this will be used for problem determination not automation
purposes. As such I would assume that the errno failure code
was reported here. If I received a value that wasn't consistent
with this I would have to search for product specific documentation.

If agent capability statements where widely used I would suggest that
an implementation report how they implemented this object in the case
that errno values where not reported. The same goes for
traceRouteCtlMiscOptions. In its case I would suggest that an
implementation of this object report in their agent capability statement
what the valid values where for this object.

>What happens when there are multiple results?  E.g., a multi-homed

Not an issue any more since there is a separate lookupResultsTable
with a results index object.

>what objects are necessary to go active?

None. There are no read-write or read-create objects in the entry
definition. Statement to this effect added to the description text.

>the DNS level makes a BIG difference in some environments.

OK.

>since some of the same issues arise here.

>possible attack vehicles.  (Payload pattern sensitivity might

Text changed.

>References need updating.

Done.

>|Copyright (C) The Internet Society (1997).  All Rights Reserved.
                                        9
Updated.

Ken