RE: Service Identity (Re: Machine Identity)

["David Harrington" <[e-mail]>]

I don't think that works very well.

We can identify the SNMP service, but there might be multiple SNMP
agents running on a device. And since different OSes have different
ideas of processes, it can be difficult to identify different
instances of the same service. (We tried to standardize facility in
the syslog WG, and couldn't come up with a standard across operating
systems.)

In SNMPv3, we developed an identifier to identify each engine, but
users actually prefer to model the network topology using the IP
address, because when dealing with topology maps the purpose is to
manage the devices in the network. 

If a device catches fire, you don't want to search through diagrams of
virtual services; you want to know where the device is so you can put
the fire out. ;-)

As Juergen said, which identifier works best depends on what you are
trying to do, and no single identifier will always be the best choice.

David Harrington
[e-mail]
[e-mail]
[e-mail]


> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Jeroen Massar
> Sent: Thursday, February 28, 2008 8:41 AM
> To: Balazs Lengyel
> Cc: [e-mail]
> Subject: Service Identity (Re: Machine Identity)
> 
> Balazs Lengyel wrote:
> > IMHO virtualization, and programs like VmWare are one 
> example where it 
> > is hard to say what are you trying to identify. The 
> physical box or the 
> > virtual machine?
> 
> One should identify the *service*
> 
> That solves all the issues mentioned here.
> 
> The service could be "your p2p app" but also "HTTP host 
> a.example.com" 
> or "HTTP host b.example.com" etc.
> 
> SSH Keys are a good example of this, they identify the SSH 
> service. You 
> can find that service on IPv4 port 22 and IPv6 port 22, maybe on 
> different other IP addresses or other port numbers. Everytime you 
> connect to that service, you can communicate with it using the same 
> public key, as it's private key remains the same. Now if another SSH

> service steals the IP address or port number, you will get a 
> different 
> key to talk with.
> 
> Solving this with HIP, but instead of "Host" making it 
> "Service" based 
> would be great.
> 
> Note that a lot of virtualization is service based, not really host 
> based. For that matter, the larger sites actually only care about 
> services: deploy 1000 HTTP proxies for site X, deploy 1000 
> crawler bots 
> for purpose Z etc. They really can't care less about the host
itself, 
> that is just a place where the service runs.
> 
> Greets,
>   Jeroen
> 
>