[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-cybox] RE: IPv4 and IPv6 Address Objects
Well for IPv4 and IPv6 the address field is just a string. So when you unmarshall the data in to your struct, it does not really matter you will have the same amount of processing either way. Right now you have to unmarshall the object before you can figure out the "type" anyway. So no difference. If we were going to have protocol specific fields in the object, then I would agree with you. But given how they are identical and I can not see us adding much to them over time, I question which way makes more sense. This would be attune to the labels that we do all over the place in STIX. Now I am not advocating that we have this be a general purpose Address object... I think it should be an IP object.. Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
|
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]