idxp-java-discuss — General discussion of IDXP Java, for both developers and users of the package.

[idxp-java-discuss] May I have access to the IDXP Implementation please?!

[Maryam A. <m.a...@gm...>]

Dear all,
I'm a MS Student and as a part of my thesis I need to do some modifications
in IDXP and IDMEF. I'm looking for an existing implementation of IDXP and
will be very happy if you can help me. The implementaion will be cited in
all documents.

Sincerely,
Maryam Azadi

[idxp-java-discuss] Re: [idxp-java-developers] idxp4j

[Nathan C. <nc...@bi...>]

I'd like to mention I'm still interested in this, and am trying to convince
an honours student I am supervising (who is working on IDXP) to work on the
java implementation to save me doing work when I have to be concentrated on
finishing my Masters. However, I'd still like to help, and will definitely
contribute my meager coding skills in spare time provided someone can
motivate me (i.e., me!).

Anyone else interested and willing to volunteer for modules? I can assure
the team that provided we can get it going soon, I can incoporate it into an
open source monitoring system I'm working on that will hopefully in beta in
the next few months.

Nathan.
----- Original Message -----
From: "Ben Feinstein" <me...@be...>
To: <idx...@li...>;
<idx...@li...>
Cc: <bee...@li...>
Sent: Saturday, April 20, 2002 1:26 AM
Subject: [idxp-java-developers] idxp4j


> Hey ya'll,
>
> Its been a long time since I sent mail out to the idxp-java lists.  I hope
> none of you thought I dropped off the face of the planet :)
> Unfortunately, in the interim, the project to implement IDXP in Java has
> been languishing.  Due to serious constraints on my time, I've been unable
> to devote the effort to this that it truly deserves.
>
> I'd like to attempt to reengage the people here on contributing to the
> project.  Perhaps someone would like to take over as the project lead, if
> they think they have real time to devote?  I'm ready to commit more of my
> time, but I really need the participation of others.  The CVS module
> 'idxp4j' should now be the target for any development, and contains a
> number of compilable but only partially-functional IDXP classes.  A brief
> description of the know issues is in the README.txt file.  Even just
> helping me debug and fix the current hanging in the handshake would be a
> great help!
>
> Cheers,
> Ben
>
>
> _______________________________________________
> idxp-java-developers mailing list
> idx...@li...
> https://lists.sourceforge.net/lists/listinfo/idxp-java-developers

[idxp-java-discuss] idxp4j

[Ben F. <me...@be...>]

Hey ya'll,

Its been a long time since I sent mail out to the idxp-java lists.  I hope
none of you thought I dropped off the face of the planet :)  
Unfortunately, in the interim, the project to implement IDXP in Java has
been languishing.  Due to serious constraints on my time, I've been unable
to devote the effort to this that it truly deserves.

I'd like to attempt to reengage the people here on contributing to the
project.  Perhaps someone would like to take over as the project lead, if
they think they have real time to devote?  I'm ready to commit more of my
time, but I really need the participation of others.  The CVS module
'idxp4j' should now be the target for any development, and contains a
number of compilable but only partially-functional IDXP classes.  A brief
description of the know issues is in the README.txt file.  Even just
helping me debug and fix the current hanging in the handshake would be a
great help!

Cheers,
Ben

[idxp-java-discuss] IDXP-03 RC7

[<Ben...@gu...>]

Hey ya'll,

Here is IDXP-03 RC7, incorporating some minor suggested changes from Mike
Erlinger and Greg Matthews. Also, I've put the IDXP URI under the
http://iana.org/beep/transient namespace, in line with the BEEP BCP that is
under consideration.

If I hear nothing on the list in the next couple of days, this version will
be submitted as IDXP-03.

Also, I've moved the XML source for the IDXP Internet-Draft to the CVS
repository of the IDXP-Java project at Sourceforge. It is now available for
read-only anonymous CVS access. The module name is "idxp-doc".
http://sourceforge.net/projects/idxp-java/

Cheers,
Ben

 <<draft-ietf-idwg-beep-idxp-03-RC7.txt>>  
<<draft-ietf-idwg-beep-idxp-03-RC7.html>> 

> Ben Feinstein
>   Software Development Engineer, R & D
>   W: 770.645.0463 F: 770.645.8311 M: 678.772.4126
>   8302 Dunwoody Pl., Suite 320, Atlanta, GA 30350 www.guardent.com
> _____________________________________________________
> G U A R D E N T
>   Enterprise Security and Privacy Programs
> 

[idxp-java-discuss] IDXP-03 RC6

[<Ben...@gu...>]

Hey ya'll,

Here is IDXP-03 Release Candidate 6, incorporating further feedback from
Darren New.

Three modifications since RC5:

1) I've removed all URLs within DTD ENTITY declarations.

2) I've indicated that the IANA should change the IDXP profile
indentification to "http://iana.org/beep/IDXP" upon adoption of IDXP as a
standards-track BEEP profile.

3) I've indicated that the RFC Editor should remove Appendix B, "History of
Significant Changes" and its corresponding TOC reference prior to
publication.

Cheers,
Ben

 <<draft-ietf-idwg-beep-idxp-03-RC6.txt>>  
<<draft-ietf-idwg-beep-idxp-03-RC6.html>> 
> Ben Feinstein
>   Software Development Engineer, R & D
>   W: 770.645.0463 F: 770.645.8311 M: 678.772.4126
>   8302 Dunwoody Pl., Suite 320, Atlanta, GA 30350 www.guardent.com
> _____________________________________________________
> G U A R D E N T
>   Enterprise Security and Privacy Programs
> 

[idxp-java-discuss] IDXP-03 RC5

[<Ben...@gu...>]

Hey ya'll,

Here is IDXP-03 Release Candidate 5, encorporating the comments I received
this afternoon from Darren New and John White.  My reply to John's comments
are below.

Cheers,
Ben

-----Original Message-----
From: John C. C. White [mailto:jc...@mi...]
Sent: Tuesday, September 04, 2001 3:43 PM
To: Ben...@gu...
Cc: idx...@li...; jer...@gu...
Subject: Re: [idxp-java-discuss] IDXP-03 RC4


> A few comments:
>
> Section 3.3   I think the first sentence should be "MUST" instead of
> "may", unless there are other MIME content-types possible.

Agreed.

> Section 3.4.1  The last sentence of the first paragraph should start
> with "One" instead of "Zero." Otherwise it's just a tautology (i.e.,
> there are no other conceivable possibilities, so it's not meaningful).
> Same for the only paragraph of section 3.4.2, and the third paragraph of
> section 4.

Agreed.

> Section 4   The third paragraph says that the "mustUnderstand" attribute
> MUST be present, but it isn't present in the first two examples after
> that, and some of the later text essentially forbids it. Perhaps it
> should be optional, with an assumed value of FALSE, if it is not present?

I agree, "mustUnderstand" is now optional and defaults to "false".

> Section 8.2 and 8.3  There are two lines that exceed the allowable line
> width; they need to be rearranged or have a continuation character
inserted.

Fixed.  Also, at Darren New's suggestion, I've eliminated the URLs in my
ENTITY declarations.

> Appendix B.1   Should include "Modified Sections 2, 3 and 4 to use the
> requirements language specified by [2]."

Agreed.

> And finally, a true nit-pick: I believe that when a sentence ends with a
> quoted element, the final period belongs INSIDE the closing quotation
> mark. This is not necessarily logical, but there are several cases in
> the document which violate this usage. My dictionary is a little vague
> on this, and I won't be offended at all if this comment is simply ignored.

I agree that grammatically, the period always belongs inside the closing
quotation mark.  However, since my use of quotation marks are really to
indicate special string values, and not quotations per se, I feel that this
deviation from proper English grammer is warranted.  Otherwise, a resonable
person might misconstrue that the period is really a part of the special
string value.  Does this seem reasonable to others?

Re: [idxp-java-discuss] IDXP-03 RC4

[John C. C. W. <jc...@mi...>]

A few comments:

Section 3.3   I think the first sentence should be "MUST" instead of
"may", unless there are other MIME content-types possible.

Section 3.4.1  The last sentence of the first paragraph should start
with "One" instead of "Zero." Otherwise it's just a tautology (i.e.,
there are no other conceivable possibilities, so it's not meaningful).
Same for the only paragraph of section 3.4.2, and the third paragraph of
section 4.

Section 4   The third paragraph says that the "mustUnderstand" attribute
MUST be present, but it isn't present in the first two examples after
that, and some of the later text essentially forbids it. Perhaps it
should be optional, with an assumed value of FALSE, if it is not present?

Section 8.2 and 8.3  There are two lines that exceed the allowable line
width; they need to be rearranged or have a continuation character inserted.

Appendix B.1   Should include "Modified Sections 2, 3 and 4 to use the
requirements language specified by [2]."

And finally, a true nit-pick: I believe that when a sentence ends with a
quoted element, the final period belongs INSIDE the closing quotation
mark. This is not necessarily logical, but there are several cases in
the document which violate this usage. My dictionary is a little vague
on this, and I won't be offended at all if this comment is simply ignored.

-John-



Ben...@gu... wrote:
> 
> Hey ya'll,
> ...

[idxp-java-discuss] IDXP-03 RC4

[<Ben...@gu...>]

Hey ya'll,

Here is the latest release candidate for IDXP-03. I've incorporated that
changes that Mike Erlinger, Greg Matthews, and I discussed on the conference
call last Wednesday. Please reply immediately if you find any problems with
this revision, as we are planning to submit the document the the IETF soon.

Cheers,
Ben

 <<draft-ietf-idwg-beep-idxp-03-RC4.txt>>  
<<draft-ietf-idwg-beep-idxp-03-RC4.html>> 

> Ben Feinstein
>   Software Development Engineer, R & D
>   W: 770.645.0463 F: 770.645.8311 M: 678.772.4126
>   8302 Dunwoody Pl., Suite 320, Atlanta, GA 30350 www.guardent.com
> _____________________________________________________
> G U A R D E N T
>   Enterprise Security and Privacy Programs
> 

[idxp-java-discuss] idxp-03, ready for working group submission

[Greg M. <gma...@cs...>]

Attached are the text and html. Date has been updated, as well as the
reference to TUNNEL. I'll be passing on the text to Mike for submission to
the working group... and in the words of Ben, "onto WG last call!". Thanks
go to Ben for putting together the final touches.

-Greg

[idxp-java-discuss] IDXP-03 RC3

[<Ben...@gu...>]

Hey ya'll,

Here is the latest release candidate for IDXP-03.  At the suggestion of
Craig Woods, I added a section on "Connection Teardown".

Cheers,
Ben

 <<draft-ietf-idwg-beep-idxp-03.html>>  <<draft-ietf-idwg-beep-idxp-03.txt>>


> Ben Feinstein
>   Software Development Engineer, R & D
>   W: 404.460.5193 F: 404.460.5001 M: 678.772.4126
>   3003 Summit Blvd., Suite 1500, Atlanta, GA 30319 www.guardent.com
> _____________________________________________________
> G U A R D E N T
>   Enterprise Security and Privacy Programs
> 

Re: [idxp-java-discuss] IDXP-03 RC2

[Greg M. <gma...@od...>]

Looks good to me, let's ship it (barring any negative, disparaging, or
otherwise nasty comments, of course).  : )

-Greg

On Thu, 26 Jul 2001, Ben Feinstein wrote:

> Hey ya'll,
> 
> Here is the draft I'm planning to release as IDXP-03.  The significant
> changes are the expansion of IDXP options and the registration of two
> initial options, "channelPriority" and "streamType".  Please look over the
> draft and send your feedback to the list.  The ID final submission cutoff
> date before IETF-51 is already past (July 20), but I'd like to get this
> version off to the IETF on Monday regardless.
> 
> Cheers,
> Ben Feinstein
> 

[idxp-java-discuss] IDXP-03 RC2

[Ben F. <me...@be...>]

Hey ya'll,

Here is the draft I'm planning to release as IDXP-03.  The significant
changes are the expansion of IDXP options and the registration of two
initial options, "channelPriority" and "streamType".  Please look over the
draft and send your feedback to the list.  The ID final submission cutoff
date before IETF-51 is already past (July 20), but I'd like to get this
version off to the IETF on Monday regardless.

Cheers,
Ben Feinstein

[idxp-java-discuss] Re: idxp-03

[Greg M. <gma...@od...>]

I really like the idea of a registration template for the "Option" element, and
in terms of initial options I'd go with "priority" and "stream_type". I don't
think that we should remove the "Option" element, because it provides a
mechanism by which QoS and organization of ID data transfers can be obtained.

With IAP we were limited to one logical channel over which alerts could be sent,
but with IDXP we have N number of channels, and providing the option to label
these (with the "stream_type") gives the receiver a chance to prioritize how it
handles incoming alerts. 

The "priority" option is a more direct approach that lends itself to other
scenarios...for instance we could have an IDS entity that is collecting alerts
from several sources, and it could open N different channels to transport the
alerts it collects from each on a seperate channel to the receiver. The sender
_could_ label each channel with some identifier of the source that generated the
alert, but if it's undesirable to do so the sender could simply indicate, with
priority numbers, which channel(s) should be attended to first (and second, and
third, etc).

I don't think we need the "mustUnderstand" attribute, because I don't want
"Option" elements to be considered an integral part of the protocol. Regardless
of the ordering in which alerts are processed, IDXP is still doing its job of
transporting alerts in a secure fashion. As the draft currently states, peers
may ignore any "Option" elements they see, and I think we should stick by that
with the understanding that "Option" elements do not affect the basic
functionality that IDXP provides, they merely facilitate the use of BEEP
channels for QoS.

On a different note, I've updated my 'author info' in the draft, and have
attached just the text version to this email.

-Greg Matthews

On Wed, 18 Jul 2001, Ben Feinstein wrote:

> Hey ya'll,
> 
> Here is a newly revised copy of IDXP.  I've changed the profile
> registration stuff and added a registration for a TCP port number.
> 
> I want to gauge support for how the group feels about the "Option" element
> in the "IDXP-Greeting".  As it stands, it can be anything.  I think we
> should create a registration template and IANA listing for IDXP Options.  
> Also, I feel we should add a "mustUnderstand" attribute to the "Option"
> element which specifies whether the option, if unrecognized, must cause an
> error in processing to occur.  This is a subset of how options are handled
> in APEX.  See section 5 and 7.1 and appendix B of
> http://www.ietf.org/internet-drafts/draft-ietf-apex-core-04.txt
> 
> Also, any ideas for one or two initial options to register?  Perhaps a
> "statusRequest" Option indicating that the greeting is querying the IDXP
> peer for status?  Or a "severity" or "priority" option on the
> greeting?  What do ya'll think?
> 
> Also, I'd like to annouce that I've been hired by Guardent
> (http://www.guardent.com/) to be a Software Development Engineer in their
> new Atlanta R&D lab!
> 
> Cheers,
> Ben
>