Re: [BEHAVE] four data models: SYSLOG, IPFIX, SNMP, RADIUS

"Dan Wing" <dwing@cisco.com> Mon, 16 July 2012 18:10 UTC

Return-Path: <dwing@cisco.com>
X-Original-To: behave@ietfa.amsl.com
Delivered-To: behave@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEBCD11E80EA for <behave@ietfa.amsl.com>; Mon, 16 Jul 2012 11:10:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -110.49
X-Spam-Level:
X-Spam-Status: No, score=-110.49 tagged_above=-999 required=5 tests=[AWL=0.109, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6c0Sy8SF2tqf for <behave@ietfa.amsl.com>; Mon, 16 Jul 2012 11:10:55 -0700 (PDT)
Received: from mtv-iport-3.cisco.com (mtv-iport-3.cisco.com [173.36.130.14]) by ietfa.amsl.com (Postfix) with ESMTP id 648AB11E808C for <behave@ietf.org>; Mon, 16 Jul 2012 11:10:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=dwing@cisco.com; l=2006; q=dns/txt; s=iport; t=1342462300; x=1343671900; h=from:to:cc:references:in-reply-to:subject:date: message-id:mime-version:content-transfer-encoding; bh=y+rqOFL6Z9WXuUPO59qRA59XmQyiTXxTmry7qrmUXks=; b=JpzbchVX2Zy4/qcIf6ij3C4x5S85opV3Z5DA+hBdbyq2v/ae6l31TndQ EbJE3NjZt0dxCemJCSJlrPjnSGwuPuVCfCqYu04mj08qoFUpL7bFTMIvz Z79MYO00lMAu7KEn/wYcr5OLuy+xoZhKM9uuupXOcEXbkpRIe9yg3MwEe w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AiUFAJdYBFCrRDoJ/2dsb2JhbABFqhCPPYEHgiABAQEDAQEBAQUKARcQNAsFBwEDAgkPAgQBAQEnBxkOFQoJCAEBBBMLF4dcAwYFDJwhn3iKWmaGRwOIS4UFiH2NDoFmgn8
X-IronPort-AV: E=Sophos;i="4.77,595,1336348800"; d="scan'208";a="49512235"
Received: from mtv-core-4.cisco.com ([171.68.58.9]) by mtv-iport-3.cisco.com with ESMTP; 16 Jul 2012 18:11:40 +0000
Received: from dwingWS (sjc-vpn2-417.cisco.com [10.21.113.161]) by mtv-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id q6GIBdGY020075; Mon, 16 Jul 2012 18:11:40 GMT
From: Dan Wing <dwing@cisco.com>
To: 'Hannes Tschofenig' <hannes.tschofenig@gmx.net>
References: <035801cd637c$34df33f0$9e9d9bd0$@com> <0971ABA3-9A9A-46FB-BE12-7A1F27F255D7@gmx.net>
In-Reply-To: <0971ABA3-9A9A-46FB-BE12-7A1F27F255D7@gmx.net>
Date: Mon, 16 Jul 2012 11:11:39 -0700
Message-ID: <038601cd637e$7298d460$57ca7d20$@com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Ac1jfXw8ISDNwgUuQGy14DlcaWXuIgAAOFjQ
Content-Language: en-us
Cc: behave@ietf.org
Subject: Re: [BEHAVE] four data models: SYSLOG, IPFIX, SNMP, RADIUS
X-BeenThere: behave@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: mailing list of BEHAVE IETF WG <behave.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/behave>, <mailto:behave-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/behave>
List-Post: <mailto:behave@ietf.org>
List-Help: <mailto:behave-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/behave>, <mailto:behave-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 16 Jul 2012 18:10:56 -0000

> -----Original Message-----
> From: Hannes Tschofenig [mailto:hannes.tschofenig@gmx.net]
> Sent: Monday, July 16, 2012 11:04 AM
> To: Dan Wing
> Cc: Hannes Tschofenig; behave@ietf.org
> Subject: Re: [BEHAVE] four data models: SYSLOG, IPFIX, SNMP, RADIUS
> 
> You of course forgot Diameter:
> http://tools.ietf.org/html/draft-ietf-dime-nat-control-17
> 
> Operators deploy different protocols for different purposes.

That was not my question.  

My question was forcing operators to deploy multiple protocols to meet their
purposes.

-d


> The world would be great if everyone could agree to use only one
> protocol, like in the voice over IP world (for example)...
> 
> On Jul 16, 2012, at 8:55 PM, Dan Wing wrote:
> 
> > As an individual, I have been worried about the possibility of
> disparate
> > data models for NATs.  We currently have four ways to report
> information
> > about a NAT or other address-sharing device,
> >
> > SYSLOG, http://tools.ietf.org/html/draft-zhou-behave-syslog-nat-
> logging-00
> > IPFIX, http://tools.ietf.org/html/draft-sivakumar-behave-nat-logging-
> 05
> > SNMP, http://tools.ietf.org/html/draft-perreault-sunset4-cgn-mib
> > RADIUS,
> > http://tools.ietf.org/html/draft-cheng-behave-cgn-cfg-radius-ext-
> 03#section-
> > 4.2
> >
> > My concern is that operators may find it necessary to deploy all four
> > protocols (IPFIX, SYSLOG, SNMP, and RADIUS) to get their needed
> logging and.
> > This seems undesirable.  Imagine, for example, that only one of those
> > protocols supported pseudo-random port assignment but only one other
> > protocol provided alarms for when a subscriber consumed all their
> ports (and
> > thus might open a support case with the operator that "the Internet
> is
> > down").
> >
> > Are my concerns misplaced?
> >
> > -d
> >
> >
> > _______________________________________________
> > Behave mailing list
> > Behave@ietf.org
> > https://www.ietf.org/mailman/listinfo/behave