Re: Last Call: <draft-kucherawy-marf-source-ports-03.txt> (Source Ports in ARF Reports) to Proposed Standard

[Scott Kitterman <[e-mail]>]

On Monday, May 07, 2012 12:50:25 PM The IESG wrote:
> The IESG has received a request from an individual submitter to consider
> the following document:
> - 'Source Ports in ARF Reports'
>   <draft-kucherawy-marf-source-ports-03.txt> as Proposed Standard
...

I think adding the source port field has value, particularly for abuse 
reporting, but I think making it RECOMMENDED for authentication failure 
reporting is not appropriate.

The last two paragraphs of section three read (trivial typo - there's an extra 
new line in the first paragraph that I removed here):

   When any report is generated that includes the "Source-IP" reporting
   field (see Section 3.2 of [ARF]), this field SHOULD also be present,
   unless the port number is unavailable.

   Use of this field is RECOMMENED for reports generated per
   [AUTHFAILURE-REPORT] (see Section 3.1 of that document).

The first corresponds to use in abuse reporting.  As described in this draft 
and the references, I think the addition of source ports for abuse reports is 
well justified.  OTOH, if you look at Section 3.1 of RFC 6591  [AUTHFAILURE-
REPORT], it gives the purpose of the most of the various data elements it 
RECOMMENDS as "to aid in diagnosing the authentication failure."

I'm not aware of any authentication methods supported by RFC 6591  
[AUTHFAILURE-REPORT] where source port makes a difference in authentication 
results.  If RFC 6591 is extended in the future to include one that does, that 
would be the time to make source port RECOMMENDED for authentication failure 
reports.  In the mean time it's just additional overhead and message size.

My suggestion would be to change the last part of section three to read:

   When any authentication failure report [AUTHFAILURE-REPORT] is generated
   that includes the "Source-IP" reporting field (see Section 3.1 of
   [AUTHFAILURE-REPORT]]), this field MAY also be included.

Other than that, I think it's ready to go.

Scott K