Subject: [BEHAVE] Comments on draft-ietf-behave-lsn-requirements-02

From: Nejc Škoberne <[email-masked]>
Date: Wed, 10 Aug 2011 15:37:10 +0100

Dear all,

I have a few comments on draft-ietf-behave-lsn-requirements-02. You say 
in section »4. Logging«:

    In order to be able to do this, the CGN would need to log the
    following information for each mapping created:

    o  internal source address [(or tunnel end point identifier)]
    o  internal source port
    o  external source address
    o  external source port
    o  destination address (but see below)
    o  destination port (but see below)
    o  timestamp

I wonder why do I need to log the »internal source port« in order to 
achieve legal traceability? If we look at different CGN schemes:

  1. NAT444: here we need only IPv6 internal source address in order to
  uniquely identify the customer

  2. DS-Lite: here we need only IPv6 tunnel end point of the customer's
  CPE in order to uniquely identify the customer

  3. NAT64: here we need only IPv6 source address in order to uniquely
  identify the customer

Do you agree? If we wanted to uniquely identify _the machine_ in the 
customer's network, _then_ we could also log »internal source port«, but 
we would probably have to on logging on the CPE as well, which I don't 
think is feasible nor desirable.

Also, I extended the first bullet point since it is not necessarily the 
actual source address you need to log in order to identify the customer, 
but can be a tunnel end point as well (DS-Lite). Do you agree?

Thanks,

Nejc