Subject: Re: [BEHAVE] Question on draft-ietf-behave-lsn-requirements-03.txt

From: "Howard, Lee" <[email-masked]>
Date: Thu, 1 Sep 2011 08:04:09 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Simon
> Perreault
> [email-masked] wrote, on 08/31/2011 01:36 PM:
> > The rationale here is that in many countries, law enforcement agencies mandate
> > to keep
> > these logs for at least a year, sometimes even longer.
>
> Not disagreeing with you, but I fear that this rationale would go against RFC2804:
>
>    The IETF has decided not to consider requirements for wiretapping as
>    part of the process for creating and maintaining IETF standards.

Wiretapping is not the same as logging.  But the rationales for rfc2804 would apply
in this case.

Response to abuse complaints would be pretty operational.  One form of abuse
complaint is the subpoena.  Without logs, there's no way to know who the
accused abuser is.

Lee

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

---

From: Tina TSOU <[email-masked]>
Date: Wed, 31 Aug 2011 20:24:25 +0000

Jean-Francois and Simon,
I think log and data retention is a normal requirement for CGN, and little data storage size is desired. The log capacity should not impact device performance.

Best Regards,
Tina TSOU
http://tinatsou.weebly.com/contact.html

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, August 31, 2011 11:41 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [BEHAVE] Question on draft-ietf-behave-lsn-requirements-03.txt

>> to keep these logs for at least a year, sometimes even longer.
> I feel like it would make a stronger rationale if we focus on other advantages
> of bulk port allocation...

Good point. The definition of wiretapping in RFC2804 is wide enough that logging
source ports is probably (barely) included in this context.

Other advantages would be interesting, but I can't see any other reason to keep
logs on the long term besides heating a building with spinning hard drives.

>> With the numbers you refered
>> to above (2.7 TB/day), this means nearly 1 Petabyte of storage per year *per CGN
>> device*.
> That with 1,000,000 bindings/sec, which is a lot. That's 15 IP addresses worth
> of external ports consumed per second. That's a really big NAT!

Of course, but even if logging is an order of magnitude smaller, this is only one
NAT box in a network presumably using several CGNs. CGN is, by definition,
a really big NAT. Logging without port ranges remains a non-trivial an operational problem.

/JF