%% You should probably cite rfc8158 instead of this I-D. @techreport{ietf-behave-ipfix-nat-logging-07, number = {draft-ietf-behave-ipfix-nat-logging-07}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-behave-ipfix-nat-logging/07/}, author = {Senthil Sivakumar and Reinaldo Penno}, title = {{IPFIX Information Elements for logging NAT Events}}, pagetotal = 26, year = 2016, month = feb, day = 18, abstract = {Network operators require NAT devices to log events like creation and deletion of translations and information about the resources that the NAT device is managing. The logs are essential in many cases to identify an attacker or a host that was used to launch malicious attacks and for various other purposes of accounting. Since there is no standard way of logging this information, different NAT devices log the information using proprietary formats and hence it is difficult to expect a consistent behavior. The lack of a consistent way to log the data makes it difficult to write the collector applications that would receive this data and process it to present useful information. This document describes the formats for logging of NAT events.}, }