Subject: [BEHAVE] NAT logging drafts

From: Dave Thaler <[email-masked]>
Date: Fri, 18 Jan 2013 23:47:27 +0000

We have two individual drafts under discussion:
* draft-sivakumar-behave-nat-logging (using IPFIX)
* draft-zhou-behave-syslog-nat-logging (using SYSLOG)

Based on the WG discussion to date, we as chairs are fine adopting
both documents as WG documents (so the next rev can be
draft-ietf-behave-...-00) with the following constraints...

The two documents appear to target the same scenario but expose
different information.   Our expectation is that the two mechanisms
will either be consistent (as much as allowed by the underlying protocols)
or else they will motivate why their scenarios are inherently different.
This is a requirement before going to WGLC.

At next IETF, we would like to see a presentation on the differences
in the data/events exposed by the two drafts, where the authors of both
drafts agree on what the differences are.   We can then use the meeting
to discuss what the right way to address each difference is.

-Dave and Dan

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Sat, 19 Jan 2013 15:22:26 +0000

From: Dave Thaler <[email-masked]<mailto:[email-masked]>>
Date: Friday, January 18, 2013 6:47 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [BEHAVE] NAT logging drafts

Based on the WG discussion to date, we as chairs are fine adopting
both documents as WG documents (so the next rev can be
draft-ietf-behave-…-00) with the following constraints…

[Senthil] One of the key differences is that draft-sivakumar is broader in scope including both
CGN and non-CGN logging. Even with CGN logging, the destination address/ports may be a requirement
In some deployments that the draft-zhou does not seem to address. The other events like address
exhaustion and other resource exhaustion is not addressed in draft-zhou.

[Senthil] Ok.

Thanks
Senthil

-Dave and Dan

---

From: "Zhouqian (Cathy)" <[email-masked]>
Date: Mon, 21 Jan 2013 06:01:38 +0000

From: [email-masked] [mailto:[email-masked]] On Behalf Of Senthil Sivakumar (ssenthil)
Sent: Saturday, January 19, 2013 11:22 PM
To: Dave Thaler; [email-masked]
Subject: Re: [BEHAVE] NAT logging drafts

[Cathy] The essential difference between the two drafts is just the protocol
used: IPFIX vs. SYSLOG. In doing the SYSLOG draft, we took a conservative approach
because we had been warned in prior discussion that every operator had its own
requirements. We are quite happy to add any additional information that
the Working Group sees as desirable.

[Senthil] Ok.
[Cathy]Ok.

Best Regards,
Cathy

Thanks
Senthil

-Dave and Dan