Subject: [BEHAVE] Comments on draft-durand-server-logging-recommendations-00

From: Dave Thaler <[email-masked]>
Date: Sun, 7 Nov 2010 23:04:06 +0000

Section 1:
>   Note: this document provides recommendations for Internet facing
>   servers logging incoming connections.  Its does not provide any
>   recommendations about logging on carrier-grade NAT or other address
>   sharing tools .

Why would they not apply?  If you have an LSN with other LSNs behind it, 
then the same issues occur, right?

(also s/Its/It/)

Section 3:
>   ISP deploying IP address sharing techniques should also deploy a
>   corresponding logging architecture to maintain records of the
>   relation between customers identity and IP/port resources they
>   utilize.  However, recommendation on this topic are out of scope for
>   this document.

Grammar: 
s/customers/a customer's/
s/recommendation/recommendations/

-Dave

---

From: "SHEPPARD, SCOTT (ATTLABS)" <[email-masked]>
Date: Mon, 8 Nov 2010 08:11:08 -0500

Hello 

This was my argument as well. It will be expensive for carriers / ISPs
to implement this logging but there is no other real choice. 

The feedback I got was that this should be made a standard via the
regional bodies (ATIS, ETSI etc). 
I also think in the US the CALEA status / regulations/ Standards should
be amended to place a uniform set of expectations on this subject. 

For example how long should data be maintained (archived)?
One user session can use scores to 100's of source ports. To index all
of these ports over millions of subscribers is daunting. One alternative
is to assign a subscriber with a fixed range to ports to ease record
keeping. However that de-creases the efficiency of the CGN/LSN process.
Should this be discussed / moderated by ICAN/ ARIN etc?  So that is an
implementation issue. My personally thinking is that such data should be
saved for at least 6 months and not more than 1 year. 

In the end for forensic analysis of an event with CGN/LSN etc the tuple
of unique private IP, Patted Public IP, date, Time, Source port(s) and
Subscriber ID must be recorded by the ISPs. Further, all times should be
accurate to at least 1 second and be reported in UTC time. Likewise, for
the web facing server side the tuple Date, Time, source IP, destination
IP and Source port(s) used should be maintained for a similar time
period. This is not for the express support of LEAs. It is survival for
all internetworking users to protect ourselves for unfortunate
accidental and criminal activities.

The implementation of this should aim for ASAP and realistically I think
this should be 2nd quarter 2011. 

Obviously, I do not know the plans for implementation of CGN/LSN across
all providers but I can say this is a reasonable (perhaps aggressive)
time frame. 

Scott Sheppard
PMTS
ATT Labs.  

-----Original Message-----
From: Dave Thaler [mailto:[email-masked]] 
Sent: Sunday, November 07, 2010 6:04 PM
To: 'behave' ([email-masked]);
[email-masked]
Subject: Comments on draft-durand-server-logging-recommendations-00

(also s/Its/It/)

Grammar: 

-Dave