Re: [BEHAVE] NAT logging drafts

["Senthil Sivakumar (ssenthil)" <[e-mail]>]

From: Dave Thaler <[e-mail]<mailto:[e-mail]>>
Date: Friday, January 18, 2013 6:47 PM
To: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: [BEHAVE] NAT logging drafts

We have two individual drafts under discussion:
* draft-sivakumar-behave-nat-logging (using IPFIX)
* draft-zhou-behave-syslog-nat-logging (using SYSLOG)

Based on the WG discussion to date, we as chairs are fine adopting
both documents as WG documents (so the next rev can be
draft-ietf-behave-…-00) with the following constraints…

The two documents appear to target the same scenario but expose
different information.   Our expectation is that the two mechanisms
will either be consistent (as much as allowed by the underlying protocols)
or else they will motivate why their scenarios are inherently different.
This is a requirement before going to WGLC.

[Senthil] One of the key differences is that draft-sivakumar is broader in scope including both
CGN and non-CGN logging. Even with CGN logging, the destination address/ports may be a requirement
In some deployments that the draft-zhou does not seem to address. The other events like address
exhaustion and other resource exhaustion is not addressed in draft-zhou.

At next IETF, we would like to see a presentation on the differences
in the data/events exposed by the two drafts, where the authors of both
drafts agree on what the differences are.   We can then use the meeting
to discuss what the right way to address each difference is.

[Senthil] Ok.

Thanks
Senthil

-Dave and Dan