Subject: [ipfix-req] Requirements draft issues - Reinaldo 1

From: "Reinaldo Penno" <[email-masked]>
Date: Mon, 30 Sep 2002 21:26:12 -0700

Issue Number : Reinaldo 1

Issue: 

I think there are some important packet fields/scenarios that should be
included in the requirements draft. 

1 - We discussed a long time ago to include the VPN-ID as one of the
parameters exported. If Ipfix will be used in VPN environments for
accouting, QoS, monitoring, etc, this field is a must.

2 - There is mention to intrusion detection/security as one of the
applications for IPfix, but there is no requirement to export NATed flows
(before and after).

In a device that supports NAT (traditional, layer 7 interception, whatever)
and it's going to use IPfix for security/intrusion detection, dealing with
NAT is must. There is no way any intrusion detection device will find
attacker/attacked properly without both sides of a NAT flow. Not to mention
accouting, billing, etc.

Proposed Modification : 

I would propose to include both items on the requirements draft.