Subject: Re: [BEHAVE] Logging drafts port block allocation/deallocation - feedback required

From: "Jagadish Shivamurthy (jshivamu)" <[email-masked]>
Date: Tue, 3 Dec 2013 05:54:48 +0000

Hi Senthil,
Based on our NAT implementations (CGNAT) -

  1.  Do not see a need to allocated non-contiguous blocks.
  2.  We allocated one block and allocate a second only when the first block is used up. So, again do not see a specific use case. If there is an use case, it can always be handled using two events.

Thanks
Jagadish

From: "Senthil Sivakumar (ssenthil)" <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, 3 December 2013 9:12 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: Tom Taylor <[email-masked]<mailto:[email-masked]>>
Subject: [BEHAVE] Logging drafts port block allocation/deallocation - feedback required

Tom and I had some offline discussions on the port block allocation/deallocation mechanics. We would like to solicit some feedback on this.
Essentially, the questions boil down to these two:
1. If the non-contiguous ports are useful/necessary. What we mean is if 32 ports are allocated for a user, can they be 1024, 1026, 1028…. Etc?
2. If multiple ranges is to be logged in a single log event. For eg. Ports 1024-1047 and 5000-5010 are allocated for a user, can we log them as two events.
I think the answer to this question probably goes to if NAT implementations would/should do this.

Thanks
Senthil

---

From: Tom Taylor <[email-masked]>
Date: Tue, 03 Dec 2013 09:10:26 -0500

Even with non-contiguous allocations, we only needed three parameters, 
not four, to describe the allocation.

I was too bound up with MAP, which is irrelevant here, when I set up the 
SYSLOG scheme.

I propose that both SYSLOG and IPFIX go with a two-parameter 
description: minimum and maximum port numbers in the allocated range.

Tom

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Wed, 4 Dec 2013 02:56:42 +0000

Ok, I agree, the next rev of IPFIX draft will have just the two parameters.

On 12/3/13 9:10 AM, "Tom Taylor" <[email-masked]> wrote:

>>    2.  We allocated one block and allocate a second only when the first
>>block is used up. So, again do not see a specific use case. If there is
>>an use case, it can always be handled using two events.
>>
>> Thanks
>> Jagadish
>>
>>
>> From: "Senthil Sivakumar (ssenthil)"
>><[email-masked]<mailto:[email-masked]>>
>> To: "[email-masked]<mailto:[email-masked]>"
>><[email-masked]<mailto:[email-masked]>>
>> Cc: Tom Taylor 
>><[email-masked]<mailto:[email-masked]>>
>> Tom and I had some offline discussions on the port block
>>allocation/deallocation mechanics. We would like to solicit some
>>feedback on this.
>> 1. If the non-contiguous ports are useful/necessary. What we mean is if
>>32 ports are allocated for a user, can they be 1024, 1026, 1028Š. Etc?
>> 2. If multiple ranges is to be logged in a single log event. For eg.
>>Ports 1024-1047 and 5000-5010 are allocated for a user, can we log them
>>as two events.