Subject: [BEHAVE] FW: New Version Notification for draft-ietf-behave-ipfix-nat-logging-02.txt

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Sun, 1 Dec 2013 04:37:30 +0000

A new version that incorporates comments from Tom and others, please
review.
At this time, the only outstanding issue with respect to the ipfix and
syslog is the port block
Allocation and deallocation schemes and parameters, for which we need some
input from others.

Thanks
Senthil

On 11/30/13 2:01 AM, "[email-masked]" <[email-masked]>
wrote:

>
>A new version of I-D, draft-ietf-behave-ipfix-nat-logging-02.txt
>has been successfully submitted by Senthil Sivakumar and posted to the
>IETF repository.
>
>Filename:	 draft-ietf-behave-ipfix-nat-logging
>Revision:	 02
>Title:		 IPFIX Information Elements for logging NAT Events
>Creation date:	 2013-11-30
>Group:		 Individual Submission
>Number of pages: 15
>URL:             
>http://www.ietf.org/internet-drafts/draft-ietf-behave-ipfix-nat-logging-02
>.txt
>Status:          
>http://datatracker.ietf.org/doc/draft-ietf-behave-ipfix-nat-logging
>Htmlized:        
>http://tools.ietf.org/html/draft-ietf-behave-ipfix-nat-logging-02
>Diff:            
>http://www.ietf.org/rfcdiff?url2=draft-ietf-behave-ipfix-nat-logging-02
>
>Abstract:
>   NAT devices are required to log events like creation and deletion of
>   translations and information about the resources it is managing.  The
>   logs are required in many cases to identify an attacker or a host
>   that was used to launch malicious attacks and/or for various other
>   purposes of accounting.  Since there is no standard way of logging
>   this information, different NAT devices behave differently and hence
>   it is difficult to expect a consistent behavior.  The lack of a
>   consistent way makes it difficult to write the collector applications
>   that would receive this data and process it to present useful
>   information.  This document describes the information that is
>   required to be logged by the NAT devices.
>
>                  
>        
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>The IETF Secretariat
>