Re: [BEHAVE] I-D Action: draft-ietf-behave-syslog-nat-logging-01.txt

[Tom Taylor <[e-mail]>]

Done at last. The updated document has two new sections:

  2. Deployment Considerations
     - discusses the logging implications of the various Softwires
       transition methods, as well some considerations arising out
       of the architectural role of the NAT.

  3. NAT-Related Events and Parameters
     - is a description at a generally coding-independent level of
       the events to be logged at NATs and their associated parameters.
       In principle the contents are the same as in the IPFIX
       document, but some reconciliation may be required.

These sections are followed by SYSLOG-specific stuff: applicability 
statement, parameter and event encoding (with lots examples of complete 
logs), and an extensive IANA section. Then the usual remaining sections.

Comments are welcome. Fire away.

Tom Taylor

On 08/05/2013 11:44 AM, [e-mail] wrote:
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>   This draft is a work item of the Behavior Engineering for Hindrance Avoidance Working Group of the IETF.
>
> 	Title           : Syslog Format for NAT Logging
> 	Author(s)       : Zhonghua Chen
>                            Cathy Zhou
>                            Tina Tsou
>                            T. Taylor
> 	Filename        : draft-ietf-behave-syslog-nat-logging-01.txt
> 	Pages           : 31
> 	Date            : 2013-05-08
>
> Abstract:
>     With the wide deployment of Carrier Grade NAT (CGN) devices, the
>     logging of NAT-related events has become very important for legal
>     purposes.  The logs may be required to identify a host that was used
>     to launch malicious attacks or engage in illegal behaviour, and/or
>     may be required for accounting purposes.  This document identifies
>     the events that need to be logged and the parameters that are
>     required in the logs depending on the context in which the NAT is
>     being used.  It goes on to standardize formats for reporting these
>     events and parameters using SYSLOG (RFC 5424).  A companion document
>     specifies formats for reporting the same events and parameters using
>     IPFIX (RFC 5101).  Applicability statements are provided in this
>     document and its companion to guide operators and implementors in
>     their choice of which technology to use for logging.
>
...