[BEHAVE] short review of draft-ietf-behave-ipfix-nat-logging-00

[Dan Wing <[e-mail]>]

This is a short review of draft-ietf-behave-ipfix-nat-logging-00.  I noticed several things in this document which are similar to my review of the SYSLOG document.  Please be sure to see that review and I'm sure you will notice some similarities.

I noticed draft-ietf-behave-ipfix-nat-logging-00 also seems to not explain the nuances of logging the destination.  This not only could increase log file size, but also impacts the memory of the NAT device and forces state on otherwise-stateless devices (such as stateless NAT64, MAP-E, or MAP-T, and others).  Not to mention creates a log of user activity which reduces subscriber privacy.

I see draft-ietf-behave-ipfix-nat-logging-00 also has a 'range step size', but I am not aware of where 'step size' is explained or discussed elsewhere.  A citation within the document to wherever 'step size' is explained would be useful.  

It reads strangely that the Address Binding event described in Section 5.4.8 shows "Mandatory: No" for both IPv4 and IPv6 source addresses -- surely one or the other needs to be present for this event to make sense, the text says:
   This event will be generated when a NAT device binds a local address
   with a global address.  This binding event happens when the first
   packet of the first flow from a host in the private realm.
but I can't tell if, when a brand-new TCP SYN is sent by a client, if that causes both an Address Binding event and _also_ a "NAT44 BIB create" event, because the document does not describe a "BIB" or a "Bind entry" -- if those are well-understood terms, can a citation be added, or in-place definition be added?  Also would benefit from clarity around why there is a Address Binding event in Section 5.4.8 versus the "BIB create" events described earlier.

Similar observation as with SYSLOG on security considerations, need for clarity of the logs, and suchlike (see my SYSLOG review posted to BEHAVE).

-d