Re: Last Call: <draft-kucherawy-marf-source-ports-03.txt> (Source Ports in ARF Reports) to Proposed Standard

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 5/7/12 3:35 PM, Scott Kitterman wrote:
 On Monday, May 07, 2012 12:50:25 PM The IESG wrote:
> The IESG has received a request from an individual submitter to
> consider the following document: - 'Source Ports in ARF Reports'
> <draft-kucherawy-marf-source-ports-03.txt> as Proposed Standard
 ...

 I think adding the source port field has value, particularly for
 abuse reporting, but I think making it RECOMMENDED for authentication
 failure reporting is not appropriate.

 The last two paragraphs of section three read (trivial typo - there's
 an extra new line in the first paragraph that I removed here):

 When any report is generated that includes the "Source-IP" reporting
 field (see Section 3.2 of [ARF]), this field SHOULD also be present,
 unless the port number is unavailable.

 Use of this field is RECOMMENED for reports generated per
 [AUTHFAILURE-REPORT] (see Section 3.1 of that document).

 The first corresponds to use in abuse reporting. As described in
 this draft and the references, I think the addition of source ports
 for abuse reports is well justified. OTOH, if you look at Section
 3.1 of RFC 6591 [AUTHFAILURE- REPORT], it gives the purpose of the
 most of the various data elements it RECOMMENDS as "to aid in
 diagnosing the authentication failure."

 I'm not aware of any authentication methods supported by RFC 6591
 [AUTHFAILURE-REPORT] where source port makes a difference in
 authentication results. If RFC 6591 is extended in the future to
 include one that does, that would be the time to make source port
 RECOMMENDED for authentication failure reports. In the mean time
 it's just additional overhead and message size.

 My suggestion would be to change the last part of section three to
 read:

 When any authentication failure report [AUTHFAILURE-REPORT] is
 generated that includes the "Source-IP" reporting field (see Section
 3.1 of [AUTHFAILURE-REPORT]]), this field MAY also be included.

 Other than that, I think it's ready to go.
Dear Scott,

Agreed. Logging ports translated by LSNs is not recommended. The only tangible data represents the source IP address made available by LSN services. Both of which touch upon the changes you recommend. At some point, authentication reporting also needs to be updated as well.

Regards,
Douglas Otis



[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]