Hi Chris, I think this document is in excellent shape and encourage the WG to move it out as quickly as possible.
Nits, all minor: 1. In 4.2.2, line 3 and 4.24, line 5: Leading zeroes MUST be omitted. -> except for a value of 0, which is encoded as "0" 2. In 4.2.4, line 8: other than 0 -> other then 0 or 9999999999 (the latter case is covered above) 3. In 4.2.9, line 2, and in 5.3.2.9, line 2: Tell the RFC Editor to change this to "RFC publication rules" 4. In 5.3.2.4 and 5.2.3.6: Are leading ASCII zeros prohibited in these two cases also, or are these two different? 5. In 7.1, case (b): -> This should never happen, but I suppose there are pathological cases, e.g., mis-configurations, where more than one different but valid payload could be reconstructed. The software should at least deal with this, and perhaps either (1) use other knowledge to choose which to keep; or (2) retain all of them for later use. 6. Section 8.11: IP is so full of covert channels, that it suffices to say that this protocol doesn't really change that fact. The example is a very narrow pipe; much wider ones exist. 7. References, [RFC5226] Comma missing after T. 8. In general, I'm not sure why three or more author references are written: "Jones, A., Smith, B., and C. Brown" rather than "Jones, A., B. Smith, and C. Brown" Regards, Rich Graveman _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog
