Subject: [BEHAVE] Address bindings, BIB entries, sessions

From: Tom Taylor <[email-masked]>
Date: Fri, 13 Sep 2013 09:09:14 -0400

I have discovered the source of something that has confused me regarding 
the difference between Binding Information Base (BIB) and session 
entries. The problem was that I took my definition of session from 
RFC2663, where it is defined as a mapping between source and target 
transport addresses. This is the same as the definition of binding (as 
in BIB entry) in RFC6146.

What I had not taken into account was that RFC6146 also redefines 
session to be a relation between two hosts (i.e., something that 
includes the destination). So using the definition of session from 
RFC2663 is inconsistent with this.

My conclusion is that:
-- we should go with the RFC6146 definitions all the way, since that is 
really what the IPFIX document is already based on
-- the session creation/deletion events should be reported only if 
destination logging is enabled. In that case, BIB entry 
creation/deletion events should not be reported, since the information 
in them would overlap with the information in the session events.
-- the reverse holds if destination logging is not enabled.

I have no problem understanding address binding events as a separate issue.

Tom Taylor

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Fri, 13 Sep 2013 13:53:27 +0000

>really what the IPFIX document is already based on
I agree, not just because the IPFIX document is based on that, but because
NAT implementations have both session and BIB databases and as you noted,
they are
different.

>in them would overlap with the information in the session events.

Agreed.

>I have no problem understanding address binding events as a separate

I have also seen protocol independent BIB implementation (aka address
binding) that is not
Captured in 6146, but a binding of an address to a subscriber (no address
sharing).
And in those cases, the session/BIB doesn¹t need to be created. In those
scenarios, the 
Address binding create/delete event should be logged.

Thanks
Senthil