Source Ports in Abuse Reporting Format (ARF) Reports
updates
- rfc-6591 — Authentication Failure Reporting Using the Abuse Reporting Format
Extracted elements (11)
The deployment of IP address sharing techniques (e.g., NAT, CGN) means that source IP address alone is insufficient for unambiguous identification of the origin of abuse; source port values must also be recorded and reported.
Time accuracy is critical when generating reports that include source port information because source ports can be recycled very quickly in ISP environments, making a port value ambiguous without a precise timestamp.
The Source-Port field corresponds directly to the existing Source-IP field defined in Section 3.2 of RFC 5965 (ARF); together they completely describe the TCP connection origin of the reported abuse incident.
Report generators that include an Arrival-Date report field MAY express that date in UTC to enable simpler correlation with local records at sites following RFC 6302 logging recommendations.
Use of the Source-Port field is RECOMMENDED for reports generated per RFC 6591 (authentication failure reporting using ARF).
When any report is generated that includes the Source-IP field, the Source-Port field SHOULD also be present, unless the port number is unavailable.
When the Source-Port field is present in a report, it MUST contain the client port of the TCP connection from which the reported message originated, corresponding to the Source-IP field for the same connection.
A new ARF header field called 'Source-Port' is defined to carry the client TCP port of the connection from which a reported message originated, complementing the existing 'Source-IP' field to fully describe the origin of an abuse incident.
IANA added the 'Source-Port' entry to the 'Feedback Report Header Fields' registry, describing it as the TCP source port from which the original message was received, with status 'current' and no multiple appearances allowed.
This extension introduces no new security considerations beyond those already covered in RFC 5965 (ARF); security considerations related to source port logging are discussed in RFC 6302.
The Source-Port field uses the ABNF syntax: `source-port = "Source-Port:" [CFWS] 1*5DIGIT [CFWS] CRLF`, where CFWS represents email-style comments or folding white space imported from RFC 5322.