Subject: [Syslog-sec] RE: I-D ACTION:draft-ietf-syslog-protocol-04.txt

From: "Rainer Gerhards" <[email-masked]>
Date: Mon, 28 Jun 2004 09:46:45 +0200

Hi list,

I am editing -protocol-04 and I would appreciate some feedback on these
points here (raised some time ago):

> Why do we default to IPv6 unknown IP?  It is longer.

I can change this, but I think/hope some time IPv6 will look more
natural - no other reasoning for this.

> I also don't
> understand the value of distinguishing the IPv4 unknown IP and IPv6
> address. It is still unknown.  It also creates ambiguity, what is the
> stack supports both.

I found this possibility while describing the scenarios. I can remove
it, if that is concensus.

> "The TAG is used to denote the process sending the message."  Should
> this be a MUST?

I pass this on to the list... It sounds good, but doesn't we need to
create a TAG value repository in this case?

Rainer
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec