Subject: Logging the source port?

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 13 Nov 2009 14:49:36 +0900

At the Transport Area meeting, Alain Durand, presenting
draft-ford-shared-addressing-issues mentioned that we may well have
now to always log the source port of a TCP request, not only the
source IP address (which may well be shared), if we want traceability.

Does anyone know if it is possible with the typical TCP servers? For
instance, I find no way to do it with Apache
<http://httpd.apache.org/docs/2.2/mod/mod_log_config.html>.

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 13 Nov 2009 14:59:23 +0900

common log format doesn't capture that information...

http://onlamp.com/pub/a/apache/2004/04/22/blackbox_logs.html?page=3

that said, of the A-P or PAT box which isn't under your control in all
likelyhood anyway doesn't log the association of internal devices to
external ports then knowing the source port may not tell you that much
about which client you're talking to...

joel

Stephane Bortzmeyer wrote:
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 13 Nov 2009 16:01:53 +0900

On Fri, Nov 13, 2009 at 02:59:23PM +0900,
 Joel Jaeggli <[email-masked]> wrote 

> common log format doesn't capture that information...

No, but it seems to be in the good old "CGI" variables, as
REMOTE_PORT. If you have a Web application, not just static Web pages,
and you log yourself, you probably have this information.
 
> that said, of the A-P or PAT box which isn't under your control in
> all likelyhood anyway doesn't log the association of internal
> devices to external ports then knowing the source port may not tell
> you that much about which client you're talking to...

Alain was referring to Carrier-Grade NAT, where an IP address is
shared between people of different households. When you have an IP
address shared only inside the family, it is usually not important to
identify a specific machine. But when you want to prosecute someone
based on the IP address of the request, it is important to
differentiate neighbours :-)

I assume that the NAT routers used by Internet access providers, for
their subscribers, will log the mapping user<->(address,port)
somewhere. (This is one of the points described in the draft.)

---

From: Richard Barnes <[email-masked]>
Date: Fri, 13 Nov 2009 18:39:37 +0900

Stéphane,

In GEOPRIV, where we have a need to specify a specific endpoint in  
order to request its geolocation, we were specifically asked by  
carriers looking at CGN to add a "port" field to the identifier space:
<http://tools.ietf.org/html/draft-ietf-geopriv-held-identity-extensions-01#section-3.3.3 

--Richard

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Fri, 13 Nov 2009 10:49:36 +0100

A really big NAT serving, say, eighteen million customers, can easily be 
so dense that if there's a bit of clock skew between a web server and 
the NAT operator, another customer might have used the same port at the 
time recorded by the web server.

Therefore, I think it's safer to say that it's the NAT operator's 
responsibility to log enough. Umpteen million web sites will continue 
to use apache's common log format, so the NAT operator has to log 
what's needed to work with that format anyway.

Arnt

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 15 Nov 2009 22:43:02 +0900

On Fri, Nov 13, 2009 at 10:49:36AM +0100,
 Arnt Gulbrandsen <[email-masked]> wrote 
 a message of 11 lines which said:

> responsibility to log enough. Umpteen million web sites will
> continue to use apache's common log format, so the NAT operator has
> to log what's needed to work with that format anyway.

How could it be possible? The only way I see for the NAT operator to
be able to say that the customer X went to www.priv.no at 2241 UTC is
to log not only the source-address/source-port mapping but also the
*destinations*, which create obvious privacy issues (and would make
the log *much* larger).

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 15 Nov 2009 22:39:44 +0900

> http://onlamp.com/pub/a/apache/2004/04/22/blackbox_logs.html?page=3

More recent versions of Apache do (thanks to Tony Finch for the
information).

%{remote}p

Tested on Apache 2.2.9.

(%p is the local port).

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 16 Nov 2009 10:47:03 +0100

Stephane Bortzmeyer writes:
>  Arnt Gulbrandsen <[email-masked]> wrote a message of 11 
>  lines which said:
>

Yes. But do you see a way to avoid that, except by unrealistic 
declarations such as "all apache installations that use the common log 
format must be changed"? It's not just apache either, all other (web 
and other) servers that don't log source port.

(Btw, there is no www.priv.no, and these days I don't think you can get 
anything else under .priv.no either. The dozen-odd people who have 
.priv.no domains are allowed to keep them, that's all.)

Arnt

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Tue, 17 Nov 2009 13:15:42 +0100

Phillip Hallam-Baker writes:
> If people are required to track the source port, it is hardly 
> unrealistic to expect them to abandon a file format that does not 
> meet their legal obligations.

A misunderstanding, perhaps. Where I live, what's being talked about is 
laws that govern residents of this jurisdiction (connecting to servers 
here, or abroad, or often in the neverland of botnets). You seem to be 
thinking about laws that govern the relationship between servers 
located here and users everywhere.

Arnt

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 13 Nov 2009 07:47:17 -0500

I think these legal requirements are stupid.

But there is no way that I would regard adherence to Rob and Ari's
slapped together log format a defense against non-compliance. If you
have a legal obligation you have an obligation, end of story.

The W3C log format I designed is supported by all the Web servers I
use and allows for most data imaginable to be logged.

On Fri, Nov 13, 2009 at 4:49 AM, Arnt Gulbrandsen
<[email-masked]> wrote:
> A really big NAT serving, say, eighteen million customers, can easily be so
> dense that if there's a bit of clock skew between a web server and the NAT
> operator, another customer might have used the same port at the time
> recorded by the web server.
>
> responsibility to log enough. Umpteen million web sites will continue to use
> apache's common log format, so the NAT operator has to log what's needed to
> work with that format anyway.
>
> Arnt

-- 
-- 
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 16 Nov 2009 09:48:51 -0500

If people are required to track the source port, it is hardly
unrealistic to expect them to abandon a file format that does not meet
their legal obligations. The technology required to address this issue
has only been around for 13 years.

If I was a part of a police investigation and a site operator had not
logged information that I thought they were obliged to log, I would be
putting them up on a charge irregardless of whether they considered it
the job of the NAT operator to do the work.

It is never safer to say that it is someone else's responsibility to
ensure that you meet your legal obligations.

Some parts of the Internet change very slowly, but others change
quickly. The parts that change quickly are those where the person who
has an interest in the change has the ability to make it.

On Mon, Nov 16, 2009 at 4:47 AM, Arnt Gulbrandsen
<[email-masked]> wrote:
>>  Arnt Gulbrandsen <[email-masked]> wrote a message of 11  lines
>> which said:
>>
>>>  responsibility to log enough. Umpteen million web sites will  continue to
>>> use apache's common log format, so the NAT operator has  to log what's
>>> needed to work with that format anyway.
>>
>> *destinations*, which create obvious privacy issues (and would make the
>> log *much* larger).
>
> Yes. But do you see a way to avoid that, except by unrealistic declarations
> such as "all apache installations that use the common log format must be
> changed"? It's not just apache either, all other (web and other) servers
> that don't log source port.
>
> anything else under .priv.no either. The dozen-odd people who have .priv.no
> domains are allowed to keep them, that's all.)
>
> Arnt