On Monday, May 07, 2012 12:50:25 PM The IESG wrote:
The IESG has received a request from an individual submitter to consider
the following document:
- 'Source Ports in ARF Reports'
<draft-kucherawy-marf-source-ports-03.txt> as Proposed Standard
...
I think adding the source port field has value, particularly for abuse
reporting, but I think making it RECOMMENDED for authentication failure
reporting is not appropriate.
The last two paragraphs of section three read (trivial typo - there's an extra
new line in the first paragraph that I removed here):
When any report is generated that includes the "Source-IP" reporting
field (see Section 3.2 of [ARF]), this field SHOULD also be present,
unless the port number is unavailable.
Use of this field is RECOMMENED for reports generated per
[AUTHFAILURE-REPORT] (see Section 3.1 of that document).
The first corresponds to use in abuse reporting. As described in this draft
and the references, I think the addition of source ports for abuse reports is
well justified. OTOH, if you look at Section 3.1 of RFC 6591 [AUTHFAILURE-
REPORT], it gives the purpose of the most of the various data elements it
RECOMMENDS as "to aid in diagnosing the authentication failure."
I'm not aware of any authentication methods supported by RFC 6591
[AUTHFAILURE-REPORT] where source port makes a difference in authentication
results. If RFC 6591 is extended in the future to include one that does, that
would be the time to make source port RECOMMENDED for authentication failure
reports. In the mean time it's just additional overhead and message size.
My suggestion would be to change the last part of section three to read:
When any authentication failure report [AUTHFAILURE-REPORT] is generated
that includes the "Source-IP" reporting field (see Section 3.1 of
[AUTHFAILURE-REPORT]]), this field MAY also be included.
Other than that, I think it's ready to go.
Scott K