Subject: [Syslog-sec] -transport-udp, section 4.2 - source port

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 17 Jun 2004 14:02:52 +0200

WG,

4.2 says:

###
   Each syslog sender process MUST attempt to use the same source port
   for the life of the process.  If due to an error or other condition
   it becomes impossible for the process to continue to use the same
   port, it MAY start using a new source port, but it MUST generate a
   new random MessageId for the first message after changing the port
   and then MUST continue incrementing the new MessageId value for
   subsequent messages.
###

Is the MUST really necessary? I think a SHOULD would do nicely.

Reasoning:
Look at a multi-threaded sender, sending syslog messages from multiple
concurrently running threads. In such an implementation, each thread
eventually has its own send socket and as such the source port will not
be consistend within the process. Of course, for a single fragmented
message, the source would be consistent, as this would be sent by a
single thread.

I opt to make it a SHOULD.

Rainer
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Anton Okmianski" <[email-masked]>
Date: Thu, 17 Jun 2004 11:13:27 -0400

Rainer, I think this is a very good point.  I will have to explain the
scenario, so it is clear why it is a should and update some text
around description of use of MessageId field as well.  With your
use-case, each thread may have its own MessageId field it increments.
This would not violate current draft, but would go against its
recommendation.  

I will update the draft to reflect your proposal if I hear no
objections from others. 

Thanks!

Anton. 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> Of Rainer Gerhards
> Sent: Thursday, June 17, 2004 8:03 AM
> To: [email-masked]
> Subject: [Syslog-sec] -transport-udp, section 4.2 - source port
> 
> 
> WG,
> 
> 4.2 says:
> 
> ###
> Look at a multi-threaded sender, sending syslog messages from 
> multiple concurrently running threads. In such an 
> implementation, each thread eventually has its own send 
> socket and as such the source port will not be consistend 
> within the process. Of course, for a single fragmented 
> message, the source would be consistent, as this would be 
> sent by a single thread.
> 
> http://www.employees.org/mailman/listinfo/sysl> og-sec
>