3 ms·

Actually, the short version is: I wanted it easily debuggable by a network admin. (It's a point he made repeatedly). All the other arguments were moot.

by groby_b 15y ago

huhtenberg 15y ago
So the network protocol must be in text so that a network admin could debug it? This is absurd.
- groby_b 15y ago
  Not as absurd as you'd think. You don't want to debug the protocol itself, but you want to be able to easily read what messages were exchanged. I get the rationale. But I think it's weak, and this entire post is lots of fluff around that core rationale. (I've been writing extensible binary protocols back in 1988 - and it never struck me as particularly difficult even back then.)
- tptacek 15y ago
  How does a network admin debug a binary protocol for which no dissector has been implemented/merged into core for Wireshark, and no decoder has been written for tcpdump? It's obviously doable, but it's very painful.
  - jacques_chester 15y ago
    On the other hand, are Wireshark and tcpdump now the gatekeepers for new protocols?
    - tptacek 15y ago
      What's your point? I'm not making a value judgement.
      - jacques_chester 15y ago
        You say that to me a lot. My point is that I imagine a network designer shouldn't focus on Wireshark or tcpdump integration over other non-functional requirements such as, well, network performance. Network performance isn't as visible as the non-functional requirement of inspectability because it is amortised over potentially millions of machines, whereas inspectability is an immediately visible issue to the select few who "pop the hood" to fix an issue or simply to have a look. For example: in terms of network capacity, I wonder how much HTTP headers cost all of us collectively. Probably a lot more than the cost of making a Wireshark plugin and having sysadmins install it as necessary. Edit: put another way, I think designers should prioritise the needs of the people who pay the cost of network operation over the convenience of the operators. There's a feedback loop here -- if it's too hard and thus very expensive to operate a system, then optimising for performance was a false win. But I don't think this is such a case, especially since as you pointed out elsewhere there are a number of very mature binary wire formats that were extant in 2007.
        tptacek 15y ago
        See: http://cr.yp.to/sarcasm/modest-proposal.txt http://cr.yp.to/sarcasm/modest-proposal.txt "I implore [you] to remember Dave and Virginia, preying on the drug addicts of the next generation and the sexually dissatisfied men of the previous generation. How different their careers could have been if their parents had not downloaded so many terabytes of data! We must not abandon our children to such a fate."
  - marshray 15y ago
    Isn't Wireshark extensible in Lua? I can see both sides of the argument here, but basing a protocol on text just for the ease of eyeballing it on-the-wire seems like optimizing for the uncommon case. Heck, almost any decent protocol should only have ciphertext on-the-wire anyway.
    - tptacek 15y ago
      That's more or less like saying "well they can just write the decode". They're network administrators. If you use an ASCII protocol, they don't have to do anything.
      - marshray 15y ago
        I'm saying someone can write the decode and share it on their blog post or Github and your admin can start using it without having to recompile Wireshark. (I think, haven't actually tried it myself). But even still, this only matters if: A. The protocol is so new that Wireshark isn't shipping a parser, B. the admin's stuff isn't working, C. the admin can't get his stuff working by normal troubleshooting and must resort to observing the protocol, D. the admin can't get his stuff working by observing the binary representation of the protocol, and E. the admin actually can get his stuff working with a transliterated ASCII representation of the protocol. Certainly I would probably find it easier to troubleshoot a text-based protocol too. I just think it's a relatively minor case in the grand scheme of things.
  - huhtenberg 15y ago
    How does a sysadmin debug a binary application for which he doesn't have any symbols?

Actually, the short version is: I wanted it easily debuggable by a network admin. (It's a point he made repeatedly). All the other arguments were moot.

by groby_b 15y ago

Actually, the short version is: I wanted it easily debuggable by a network admin. (It's a point he made repeatedly). All the other arguments were moot.

huhtenberg 15y ago

So the network protocol must be in text so that a network admin could debug it? This is absurd.

groby_b 15y ago
Not as absurd as you'd think. You don't want to debug the protocol itself, but you want to be able to easily read what messages were exchanged. I get the rationale. But I think it's weak, and this entire post is lots of fluff around that core rationale. (I've been writing extensible binary protocols back in 1988 - and it never struck me as particularly difficult even back then.)
tptacek 15y ago
How does a network admin debug a binary protocol for which no dissector has been implemented/merged into core for Wireshark, and no decoder has been written for tcpdump? It's obviously doable, but it's very painful.
- jacques_chester 15y ago
  On the other hand, are Wireshark and tcpdump now the gatekeepers for new protocols?
  - tptacek 15y ago
    What's your point? I'm not making a value judgement.
    - jacques_chester 15y ago
      You say that to me a lot. My point is that I imagine a network designer shouldn't focus on Wireshark or tcpdump integration over other non-functional requirements such as, well, network performance. Network performance isn't as visible as the non-functional requirement of inspectability because it is amortised over potentially millions of machines, whereas inspectability is an immediately visible issue to the select few who "pop the hood" to fix an issue or simply to have a look. For example: in terms of network capacity, I wonder how much HTTP headers cost all of us collectively. Probably a lot more than the cost of making a Wireshark plugin and having sysadmins install it as necessary. Edit: put another way, I think designers should prioritise the needs of the people who pay the cost of network operation over the convenience of the operators. There's a feedback loop here -- if it's too hard and thus very expensive to operate a system, then optimising for performance was a false win. But I don't think this is such a case, especially since as you pointed out elsewhere there are a number of very mature binary wire formats that were extant in 2007.
      - tptacek 15y ago
        See: http://cr.yp.to/sarcasm/modest-proposal.txt http://cr.yp.to/sarcasm/modest-proposal.txt "I implore [you] to remember Dave and Virginia, preying on the drug addicts of the next generation and the sexually dissatisfied men of the previous generation. How different their careers could have been if their parents had not downloaded so many terabytes of data! We must not abandon our children to such a fate."
- marshray 15y ago
  Isn't Wireshark extensible in Lua? I can see both sides of the argument here, but basing a protocol on text just for the ease of eyeballing it on-the-wire seems like optimizing for the uncommon case. Heck, almost any decent protocol should only have ciphertext on-the-wire anyway.
  - tptacek 15y ago
    That's more or less like saying "well they can just write the decode". They're network administrators. If you use an ASCII protocol, they don't have to do anything.
    - marshray 15y ago
      I'm saying someone can write the decode and share it on their blog post or Github and your admin can start using it without having to recompile Wireshark. (I think, haven't actually tried it myself). But even still, this only matters if: A. The protocol is so new that Wireshark isn't shipping a parser, B. the admin's stuff isn't working, C. the admin can't get his stuff working by normal troubleshooting and must resort to observing the protocol, D. the admin can't get his stuff working by observing the binary representation of the protocol, and E. the admin actually can get his stuff working with a transliterated ASCII representation of the protocol. Certainly I would probably find it easier to troubleshoot a text-based protocol too. I just think it's a relatively minor case in the grand scheme of things.
- huhtenberg 15y ago
  How does a sysadmin debug a binary application for which he doesn't have any symbols?