Re: [v6ops] draft-elkins-6man-ipv6-diagnostic-header (Was: draft minutes ietf 81, 3 meetings...)

On Aug 15, 2011, at 10:57 AM, nalini.elkins@insidethestack.com wrote:

> Shane,
> 
> 
>> 
>> Have you taken a look at flow-spec for IPv4:
>> http://tools.ietf.org/html/rfc5575
>> ... and, flow-spec for IPv6:
>> http://tools.ietf.org/html/draft-ietf-idr-flow-spec-v6-00
>> (Both the RFC and I-D are within the IDR WG).
>> 
>> In summary, using flow-spec one can define an ACL that then
>> get distributed across all routers within an ASN, via BGP,
>> that can then be used to count matching packets, log packet
>> header information, etc.  It's up to the operator to
>> decide what ACL to be applied and what 'action' (logging,
>> counting, etc.) to be taken for packets that match a given
>> 'rule'.  
>> 
>> From where I'm sitting, this seems like it might already
>> solve the problem you're having, without having to invent a
>> wholly new IPv6 Destination Header Option.  So, I would
>> like to know if you have taken a look at flow-spec and, if
>> so, why it was ruled out?
> 
> Certainly an interesting set of RFCs but a few questions I would have:
> 
> 1.  What if BGP is not being used?
> 
> 2.  What about matching packets at non-router devices (that is, hosts)

If you are at the host you can simply match whatever tuple you are interested in and log the entire packet, and then do whatever analysis after the fact.

> 
> 3.  I believe what we need in diagnostics is the entire packet not just a logging that such a packet existed.  For example, the problem we are looking for may be in the body of the protocol data.  Ex. a problem with FTP.  
> So, we would need the entire packet as captured by a packet analyzer rather than a log that says 'a packet from dest x to source y was sent'.  I do not imagine that the log is going to keep the entire packet.  Am I missing something?

So:
A: Capture at the end host
or
B: Capture on the network if you really must (although having taps on the physical layer causes most security minded operators to get the heebie-jeebies) and match upon tuples...

W
> 
> 
>> 
>> -shane
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 