On 5/7/12 3:35 PM, Scott Kitterman wrote:
On Monday, May 07, 2012 12:50:25 PM The IESG wrote:
> The IESG has received a request from an individual submitter to
> consider the following document: - 'Source Ports in ARF Reports'
> <draft-kucherawy-marf-source-ports-03.txt> as Proposed Standard
...
I think adding the source port field has value, particularly for
abuse reporting, but I think making it RECOMMENDED for authentication
failure reporting is not appropriate.
The last two paragraphs of section three read (trivial typo - there's
an extra new line in the first paragraph that I removed here):
When any report is generated that includes the "Source-IP" reporting
field (see Section 3.2 of [ARF]), this field SHOULD also be present,
unless the port number is unavailable.
Use of this field is RECOMMENED for reports generated per
[AUTHFAILURE-REPORT] (see Section 3.1 of that document).
The first corresponds to use in abuse reporting. As described in
this draft and the references, I think the addition of source ports
for abuse reports is well justified. OTOH, if you look at Section
3.1 of RFC 6591 [AUTHFAILURE- REPORT], it gives the purpose of the
most of the various data elements it RECOMMENDS as "to aid in
diagnosing the authentication failure."
I'm not aware of any authentication methods supported by RFC 6591
[AUTHFAILURE-REPORT] where source port makes a difference in
authentication results. If RFC 6591 is extended in the future to
include one that does, that would be the time to make source port
RECOMMENDED for authentication failure reports. In the mean time
it's just additional overhead and message size.
My suggestion would be to change the last part of section three to
read:
When any authentication failure report [AUTHFAILURE-REPORT] is
generated that includes the "Source-IP" reporting field (see Section
3.1 of [AUTHFAILURE-REPORT]]), this field MAY also be included.
Other than that, I think it's ready to go.
Dear Scott,
Agreed. Logging ports translated by LSNs is not recommended. The only
tangible data represents the source IP address made available by LSN
services. Both of which touch upon the changes you recommend. At some
point, authentication reporting also needs to be updated as well.
Regards,
Douglas Otis