Re: [dispatch] Proposed charter for work on logging

Hi Vijay,
The utility of a marker is that currently there is no SIP protocol mechanism to indicate that signalling is of interest to logging, so it is not a logging format issue but an issue of making regression testing and troubleshooting scaleable by not having to log everything. 

Thanks for the pointer to RFC 6872, I will take a look at it.

Regards,
Peter

-----Original Message-----
From: dispatch-bounces@ietf.org [mailto:dispatch-bounces@ietf.org] On Behalf Of Vijay K. Gurbani
Sent: 13 June 2013 22:23
To: dispatch@ietf.org
Subject: Re: [dispatch] Proposed charter for work on logging

On 06/13/2013 06:17 AM, Dawes, Peter, Vodafone Group wrote:
> Hello All, Following on from the comments at IETF#86 
> (http://www.ietf.org/proceedings/86/minutes/minutes-86-dispatch),
> where there was mild support for working on logging, I have updated 
> the log me requirements draft with 3 potential solutions (in clause
> 7) which can meet the requirements
> (http://www.ietf.org/internet-drafts/draft-dawes-dispatch-logme-reqs-02.txt).
> Opinions and comments on these or any other potential solutions would 
> be very welcome.

Peter: I am not being a contrarian, just being curious.

What is the utility of a log-me marker if all traffic is logged through a mechanism such as SIP CLF?

> It was commented at IETF#86 that a security analysis is needed so I 
> would like to understand if any scenarios exist with potential 
> security threats in order to add them to requirements. In many cases, 
> a network simply logs the signalling that passes through it so no new 
> security issues are created. Collecting end-to-end logging for 
> signalling that crosses multiple networks must not compromise security 
> or privacy, but I would expect networks to remove any security 
> sensitive fields before forwarding signalling regardless of whether 
> that signalling is of interest to logging.

We went through discussions related to all of the above points during the SIP CLF work.  See the Security Consideration section of [1]; it may provide you some answers.

[1] http://tools.ietf.org/html/rfc6872

Thanks,

- vijay
--
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA)
Email: vkg@{bell-labs.com,acm.org} / vijay.gurbani@alcatel-lucent.com
Web: http://ect.bell-labs.com/who/vkg/  | Calendar: http://goo.gl/x3Ogq _______________________________________________
dispatch mailing list
dispatch@ietf.org
https://www.ietf.org/mailman/listinfo/dispatch