Re: Last Call: <draft-kucherawy-marf-source-ports-03.txt> (Source Ports in ARF Reports) to Proposed Standard

[Douglas Otis <[e-mail]>]

On 5/7/12 3:35 PM, Scott Kitterman wrote:
>  On Monday, May 07, 2012 12:50:25 PM The IESG wrote:
> > The IESG has received a request from an individual submitter to
> > consider the following document: - 'Source Ports in ARF Reports'
> > <draft-kucherawy-marf-source-ports-03.txt> as Proposed Standard
>  ...
>
>  I think adding the source port field has value, particularly for
>  abuse reporting, but I think making it RECOMMENDED for authentication
>  failure reporting is not appropriate.
>
>  The last two paragraphs of section three read (trivial typo - there's
>  an extra new line in the first paragraph that I removed here):
>
>  When any report is generated that includes the "Source-IP" reporting
>  field (see Section 3.2 of [ARF]), this field SHOULD also be present,
>  unless the port number is unavailable.
>
>  Use of this field is RECOMMENED for reports generated per
>  [AUTHFAILURE-REPORT] (see Section 3.1 of that document).
>
>  The first corresponds to use in abuse reporting. As described in
>  this draft and the references, I think the addition of source ports
>  for abuse reports is well justified. OTOH, if you look at Section
>  3.1 of RFC 6591 [AUTHFAILURE- REPORT], it gives the purpose of the
>  most of the various data elements it RECOMMENDS as "to aid in
>  diagnosing the authentication failure."
>
>  I'm not aware of any authentication methods supported by RFC 6591
>  [AUTHFAILURE-REPORT] where source port makes a difference in
>  authentication results. If RFC 6591 is extended in the future to
>  include one that does, that would be the time to make source port
>  RECOMMENDED for authentication failure reports. In the mean time
>  it's just additional overhead and message size.
>
>  My suggestion would be to change the last part of section three to
>  read:
>
>  When any authentication failure report [AUTHFAILURE-REPORT] is
>  generated that includes the "Source-IP" reporting field (see Section
>  3.1 of [AUTHFAILURE-REPORT]]), this field MAY also be included.
>
>  Other than that, I think it's ready to go.
Dear Scott,

Agreed.  Logging ports translated by LSNs is not recommended.  The only 
tangible data represents the source IP address made available by LSN 
services.  Both of which touch upon the changes you recommend.   At some 
point, authentication reporting also needs to be updated as well.

Regards,
Douglas Otis