Subject: Re: [BEHAVE] Question on draft-ietf-behave-lsn-requirements-03.txt

From: Maglione Roberta <[email-masked]>
Date: Thu, 1 Sep 2011 09:48:11 +0200

In my country the law requires to keep logs for 5 years and we are not allowed to log destination information for privacy reasons.
Having the possibility to use port range would help reducing the amount of data we need to store.

Roberta

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Mikael Abrahamsson
Sent: giovedì 1 settembre 2011 7.07
To: Simon Perreault
Cc: [email-masked]
Subject: Re: [BEHAVE] Question on draft-ietf-behave-lsn-requirements-03.txt

On Wed, 31 Aug 2011, Simon Perreault wrote:

> Mikael Abrahamsson wrote, on 08/27/2011 02:31 AM:
>> I support making it a MUST requirement, due to the fact that without it, it's
>> nearly impossible to handle the logging load.
>
> According to previous calculations, the logging load is not unmanageable.
> See <http://www.ietf.org/mail-archive/web/behave/current/msg08801.html>.

There are markets where there is either already a requirement, or talk
about putting into law a requirement to save such data for 3 years. When
one is talking about many tens of gigabits/s of traffic we're talking
really serious storage systems (hundreds of terabytes if not thousands
of terabytes of storage).

Avoiding logging any kind of destination information is to be preferred,
only logging the source port range being made available for the customer
and requiring the party wanting information to supply time,IP address and
port to track an individual user, makes the logging load go down by factor
1000 or more in our calculations.

--
Mikael Abrahamsson    email: [email-masked]
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

Questo messaggio e i suoi allegati sono indirizzati esclusivamente alle persone indicate. La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza di queste informazioni sono rigorosamente vietate. Qualora abbiate ricevuto questo documento per errore siete cortesemente pregati di darne immediata comunicazione al mittente e di provvedere alla sua distruzione, Grazie.

This e-mail and any attachments is confidential and may contain privileged information intended for the addressee(s) only. Dissemination, copying, printing or use by anybody else is unauthorised. If you are not the intended recipient, please delete this message and any attachments and advise the sender by return e-mail, Thanks.

---

From: Tina TSOU <[email-masked]>
Date: Thu, 01 Sep 2011 16:54:35 +0000

From: Tina TSOU
Sent: Wednesday, August 31, 2011 1:24 PM
To: [email-masked]'; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: [BEHAVE] Question on draft-ietf-behave-lsn-requirements-03.txt

Jean-Francois and Simon,
I think log and data retention is a normal requirement for CGN, and little data storage size is desired. The log capacity should not impact device performance.

Best Regards,
Tina TSOU
http://tinatsou.weebly.com/contact.html

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, August 31, 2011 11:41 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [BEHAVE] Question on draft-ietf-behave-lsn-requirements-03.txt

>> The rationale here is that in many countries, law enforcement agencies mandate
>> to keep these logs for at least a year, sometimes even longer.
> Not disagreeing with you, but I fear that this rationale would go against RFC2804:
>
>   The IETF has decided not to consider requirements for wiretapping as
>   part of the process for creating and maintaining IETF standards.
>
> I feel like it would make a stronger rationale if we focus on other advantages
> of bulk port allocation...

Good point. The definition of wiretapping in RFC2804 is wide enough that logging
source ports is probably (barely) included in this context.

Other advantages would be interesting, but I can't see any other reason to keep
logs on the long term besides heating a building with spinning hard drives.

>> With the numbers you refered
>> to above (2.7 TB/day), this means nearly 1 Petabyte of storage per year *per CGN
>> device*.
> That with 1,000,000 bindings/sec, which is a lot. That's 15 IP addresses worth
> of external ports consumed per second. That's a really big NAT!

Of course, but even if logging is an order of magnitude smaller, this is only one
NAT box in a network presumably using several CGNs. CGN is, by definition,
a really big NAT. Logging without port ranges remains a non-trivial an operational problem.

/JF