Re: [sip-clf] SIP-CLF slides for opsarea and possibly ipfix

["Vijay K. Gurbani" <[e-mail]>]

Hadriel Kaplan wrote:
> Hi Vijay,

Hadriel: Thanks for the feedback; more inline.

> I would recommend the following changes:
> 
> 1) Get rid of the two slides on "Need for CLF in current literature".
> Neither of those two use-cases are actually addressed by SIP CLF,
> afaict.  At least not for the purpose of performing anomaly detection
> by using the CLF. (CLF would be useful to report when anomalous
> events are found perhaps, but we've said it's not a replacement for
> Syslog/SNMP event reporting, right?)  Even if you don't agree with my
> view of that, there's no need to debate it in the meeting, because
> it's not central to the need for CLF.

OK; training anomaly detection systems for semantic attacks on
SIP through the CLF may well be classified as a research topic,
so you are right -- I have taken these two slides out.

> 2) Maybe summarize the proposed charter in a slide or two?  Like list
> what's in/out-of-scope, and the deliverables?

OK; will do.

> 3) on the last slide, include opsarea in the parenthesis list, since
> that's planned for Stockholm as well I believe.

OK.

> 4) I'm not quite sure what the purpose of the "Challenges in defining
> SIP CLF" slides are, but if you're itemizing them... then add "To get
> a common view of merged/global CLF's, must choose where in the
> stack/system to log SIP messages", and "Security and privacy related
> issues of various forms".

I have put in security and privacy related issues as a bullet.

The other point -- "to get a common view of merged/global CLFs ..."
may require some discussion.  Are you proposing that there be a
central CLF server where all SIP actors in a network send their
messages for correlation?  At least my view of the SIP CLF was
more along the lines of each SIP actor producing their own
CLF.

> 5) editorial nit: slide 3, remove the word "problem" from the top,
> since this is a slide on benefits, not problems. Unless you're saying
> the problem is we don't have these benefits. ;)

Done.

The updated copy is at the same location
http://ect.bell-labs.com/who/vkg/IETF/75/IETF-75-sip-clf-vkg.ppt

Thank you for your time on this.

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/