Re: [Rucus] ARF BoF: no SIP?

["Dan Wing" <[e-mail]>]

> >Interesting that while they list SSH, FTP, and "web server" 
> >attacks as possible extensions, but SIP isn't listed.
> 
> I'll throw it into the pot.
> 
> Although there are people who wish it were otherwise, the current ARF
> format is tightly tied to reporting metadata about an individual
> e-mail message, and that's not likely to change.
> 
> There's interest in a more general abuse report, but I have not yet
> succeeded in getting people to explain why, other than a dislike of
> XML, we wouldn't just be doing a rerun of INCH.

Dunno.  I'm not familiar with INCH and currently not connected to
the Internet to figure out what it is.

My only thought is that if ARF is going to be extended to cover
things like SSH and FTP attacks, it should also cover SIP (and, 
to Peter's point) and XMPP.

SIP and XMPP are much more similar to email than ssh, as well
(From/To headers and suchlike), which may ease extending ARF
to cover SIP/XMPP than the complications of extending ARF to
report abuse of a service such as ssh.

-d


> Regards,
> John Levine, [e-mail], Primary Perpetrator of "The 
> Internet for Dummies",
> Information Superhighwayman wanna-be, 
> http://www.johnlevine.com, ex-Mayor
> "More Wiener schnitzel, please", said Tom, revealingly.