Re: [v6ops] Google Alert - IPv6

[Lee Howard <[e-mail]>]

Without any IETF hat on. . .

On 10/27/17, 12:15 AM, "v6ops on behalf of Dave O'Reilly"
<[e-mail] on behalf of [e-mail]> wrote:

>Can we regulate our way out of this problem?
>——————————————————————————————

Probably not. Countries with the highest IPv6 deployment have had either
no government influence, or little more than government talking with
industry about their IPv6 deployment plans. Countries with IPv6 mandates
on industry seem to have very low actual deployment.

>
>Considering regulation as a way to adjust economic incentives, there is
>indeed an opportunity to help to shift things along in one or more
>countries through regulation, but to what extent will this help with the
>global issue of crime attribution?

To the degree that IPv6 and/or proper port/timestamp logging is adopted.
Either will work, but this is becoming much more of a content operator
problem than an ISP or mobile carrier problem.


>It is clear that if the number of subscribers that can be simultaneously
>behind a CGNAT is limited, the deployment of IPv6 increases, and the IPv6
>adoption in Belgium bears that out.

Yes, and I think you’re right, but the Belgian interpretation that address
sharing must not exceed 16:1 may not be generalizable. That is: Belgium is
one country, and we don’t know if their rule would work everywhere.

> 
>
>However, the obvious question to ask is - are the Belgian authorities
>catching any more criminals now that they have such a high adoption rate
>of IPv6? Has the problem of crime attribution due to CGNAT gone away for
>them, or does it actually require global adoption of IPv6?

The question is more like, “Are Belgian authorities catching more
criminals than other countries in proportion to their IPv6 deployment?”
They’re probably not catching more bad guys than they were before CGN,
they’re just trying not to lose ground.
And the answer is probably not good, because although Belgium has great
numbers on eyeballs, their IPv6 deployment on content sites is still weak
(https://www.vyncke.org/ipv6status/detailed.php?country=be ).


>
>One possible solution frequently cited to the problem of CGNAT is
>migration to IPv6.However, does migration to IPv6 ACTUALLY solve the
>problem of crime attribution due to large-scale address sharing?

Only if content providers deploy IPv6, including logging.

>The problem is that law enforcement agencies do not have the required
>information to be able to ask the ISP for the subscriber identity -
>because source ports are required and not logged anywhere.
>
>So the question becomes how to address this information gap. One
>possibility is that ISPs must record all destination IP addresses for all
>TCP connections, 

If the problem is that content providers are not logging enough
information to identify users reaching their content, why in the world
would this gap become the ISPs' problem? Regulate the content providers if
they’re the ones providing insufficient information.

>
>The role of the IETF in this
>——————————————————————————————
>
>Right from the front page of the IETF website: "The mission of the IETF
>is to make the Internet work better by producing high quality, relevant
>technical documents that influence the way people design, use, and manage
>the Internet.”
>
>Large scale address sharing technologies present a challenge to the
>management of the Internet so that seems to fit right within the remit of
>the IETF to me. Correct me if I’m wrong...

Not entirely, but this seems more operational to me, and might be better
targeted as a recommendation for how to manage servers.

Lee

>
>
>
>
>> On 26 Oct 2017, at 16:00, Warren Kumari <[e-mail]> wrote:
>> 
>> On Thu, Oct 19, 2017 at 5:23 AM,  <[e-mail]> wrote:
>>> Hi Mikael, Tore, all,
>>> 
>>> You may want read:
>>>https://tools.ietf.org/html/draft-daveor-cgn-logging-00 which relies on
>>>the Europol threat assessment report
>>>(https://www.europol.europa.eu/sites/default/files/documents/europol_ioc
>>>ta_web_2016.pdf)
>>> 
>> 
>> I'm somewhat hijacking an old thread, but it would be great if we
>> could get some more review of draft-daveor-cgn-logging -- I know Dave
>> would really appreciate comments / review.
>> 
>> W
>> 
>> 
>>> As far as the IETF is concerned, I do believe that we have done our
>>>part of the job:
>>> 
>>>   1.   Identify logging as an issue in address sharing: RFC 6269
>>> 
>>>   2.   Require address sharing to enable a logging function: RFC 6269
>>>        and RFC 6888
>>> 
>>>   3.   Identify a minimal set of information to be logged: RFC 6269,
>>>        RFC 6888, and RFC 6908
>>> 
>>>   4.   Identify and discuss trade-offs of solutions to achieve logging:
>>>        RFC 6269, RFC 6908
>>> 
>>>   5.   Specify means to optimize logging (port range allocation,
>>>        deterministic NAT): draft-ietf-softwire-stateless-
>>>        4v6-motivation, RFC 7596, RFC 7597, RFC 7599, RFC 7753, and
>>>        RFC7422
>>> 
>>>   6.   Recommend servers to log source port: RFC 6302
>>> 
>>>   7.   An initial survey of servers supporting source port logging: RFC
>>>        7768
>>> 
>>>   8.   Retrieve NAT session loggings: draft-ietf-behave-syslog-nat-
>>>        logging, draft-ietf-behave-ipfix-nat-logging
>>> 
>>>   9.   Enable address sharing logging function by means of NETCONF:
>>>        draft-ietf-opsawg-nat-yang
>>> 
>>>   10.  CPU and memory issues: RFC 6908
>>> 
>>> Cheers,
>>> Med
>>> 
>>>> -----Message d'origine-----
>>>> De : v6ops [mailto:[e-mail]] De la part de Mikael
>>>> Abrahamsson
>>>> Envoyé : jeudi 19 octobre 2017 09:03
>>>> À : Tore Anderson
>>>> Cc : [e-mail]
>>>> Objet : Re: [v6ops] Google Alert - IPv6
>>>> 
>>>> On Thu, 19 Oct 2017, Tore Anderson wrote:
>>>> 
>>>>> * Mikael Abrahamsson <[e-mail]>
>>>>> 
>>>>>> If they do have a port, then LEA can have a single subscriber.
>>>>> 
>>>>> Reading the original article (linked below) I am left with the
>>>>>feeling
>>>>> that the problem is that they generally *don't* know the source port,
>>>>> and therefore end up, quote, «[unable] to identify internet
>>>>>subscribers
>>>>> on the basis of an IP address».
>>>>> 
>>>>> https://www.europol.europa.eu/newsroom/news/are-you-sharing-same-ip-
>>>> 
>>>>address-criminal-law-enforcement-call-for-end-of-carrier-grade-nat-cgn-
>>>>to-
>>>> increase-accountability-online
>>>>> 
>>>>> The article proceeds to define «CGN» as «technologies which allow
>>>>> sharing of IPv4 addresses with multiple internet users». In that
>>>>> context, MAP, even though it is not technically CGNAT, is just as
>>>>> problematic (to answer Rajiv).
>>>>> 
>>>>> C'est la vie! If Europol don't like IP address sharing, I think the
>>>>> only thing they actually could do about it would be to put pressure
>>>>>on
>>>>> regulators and/or lawmakers to accelerate IPv6 adoption. I understand
>>>>> that's what already happened in Belgium with impressive results.
>>>> 
>>>> So I have no idea what's really going on here, but I can imagine
>>>>someone
>>>> doing CGN and just NATing people left and right, and not logging
>>>>anything.
>>>> Then it's near impossible to find who did what.
>>>> 
>>>> At least when I looked into this issue, the message I got back was
>>>>that
>>>> narrowing down the user list to a few tens of subscribers was still
>>>>vastly
>>>> better than no information at all. Of course LEAs don't like it, but
>>>>it's
>>>> a lot better than nothing.
>>>> 
>>>> Also, services who are typically involved in being targeted for crimes
>>>> should start logging the source port of whoever is talking to them.
>>>>This
>>>> option is available in most web servers and has been for a
>>>>considerable
>>>> amount of time.
>>>> 
>>>> Mandating IPv6 is a hard sell. Mandating ISPs to log what subscriber
>>>> accounts was behind an IPv4 address at a given point in time including
>>>> port used by what account, that's less far fetched.
>>>> 
>>>> --
>>>> Mikael Abrahamsson    email: [e-mail]
>>> _______________________________________________
>>> v6ops mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/v6ops
>> 
>> 
>> 
>> -- 
>> I don't think the execution is relevant when it was obviously a bad
>> idea in the first place.
>> This is like putting rabid weasels in your pants, and later expressing
>> regret at having chosen those particular rabid weasels and that pair
>> of pants.
>>   ---maf
>> 
>> 
>> 
>> --===============7090974386904564375==--
>> 
>> --===============4172498714441195205==
>> Content-Type: text/plain; charset="us-ascii"
>> MIME-Version: 1.0
>> Content-Transfer-Encoding: 7bit
>> Content-Description: Digest Footer
>> 
>> _______________________________________________
>> v6ops mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/v6ops
>
>_______________________________________________
>v6ops mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/v6ops