RFC 1262

RFC 1262: Guidelines for Internet Measurement Activities 🎀

okay bestie, this is RFC 1262 and it's basically "please read this before you poke the whole Internet" 💅✨

Title block 🧾

• Stream: Network Working Group, Request for Comments 1262 🌸
• Published by: Internet Activities Board (IAB) 🧚
• Editor: Vinton G. Cerf/CNRI 💖
• Date: October 1991 🍓
• Category: Informational. It provides information for the Internet community and doesn't specify an Internet standard 📚
• Obsoletes / Updates: The title block doesn't list anything it obsoletes or updates 🫶

Status of this Memo 📚

This memo is just information for the Internet community, so it's not an Internet standard. Distribution is unlimited, so share it with everyone 💜

Summary 🌈

Measuring the Internet is critical for future development, evolution, and deployment planning 📊. Internet-wide activities can mess with normal operation, so they MUST be planned with care and made widely known beforehand 🙈. This doc gives guidance to researchers planning Internet measurements 🔭.

This RFC is IAB guidance for researchers thinking about measurement experiments on the Internet. It's not a standard. The IAB still strongly urges Internet users to follow these guidelines out of courtesy and professional respect for the community 🫶💅.

Guidelines 🦋

The Internet has glowed up SO much over the past few years in connectivity, use, and quality of service ✨. As it keeps growing and gets used for more diverse and demanding stuff, collecting data is vital. We're talking everything from low-level packet switching to what individual apps need from the network 📈. That data powers research, engineering planning, and keeping the operational infrastructure developing. But data collection also can't mess with the network's operational viability and stability, and it can't violate privacy, security, or acceptable use policies 😭. So the IAB came up with these basic guidelines for network measurement activities 💖.

In general, any data collection activity SHOULD be undertaken with professional consideration of its impact on the network's services and users, and it SHOULD be planned to hit operational or research goals with minimal impact 🌸. Sometimes data can be collected continuously, like counting packets or seeing how often specific apps get used 📊. Other times a study is too demanding to run nonstop, either because of how much effort the researcher needs or how much traffic the underlying network already carries 😅. Any data collection activity SHOULD be designed with careful thought about this, and SHOULD be tested thoroughly before it's deployed on the Internet 🧪. Anyone starting a network measurement activity SHOULD alert the relevant service providers through things like bulletin boards, mailing lists, and individual emails 📬.

Furthermore, the data being collected MUST NOT be gathered using break-ins to network systems or other illegal or unethical techniques 🚫. If a measurement activity could be read as a possible security intrusion, the researcher SHOULD make it easy for a sysadmin at a remote site to see that it's not a break-in attempt. They can do that by informing the CERT, or by making info about the study easily available through anonymous FTP or other means [1,2,3] 🔐.

More specifically, anyone attempting a network measurement activity SHOULD make sure these conditions are met 👑:

1. the data collected will not violate privacy, security, or acceptable use concerns,
2. if the aggregated data has potential for privacy intrusions, the researcher MUST protect privacy, for example by limiting published statistics so individual users or institutions aren't identified,
3. if the data collection activity may be construed to be a security violation, the researchers are strongly advised to inform the CERT in advance and, if applicable, request some guidance,
4. the data collection doesn't unduly load or otherwise interfere with the network or attached machines. In particular, if at all feasible, non-invasive measurement, like passive monitoring, SHOULD be considered as the first choice,
5. if there's an operational impact, the service providers MUST be contacted,
6. the study goals, methodology, and plans are widely available, in a way that takes minimal effort to find and retrieve, and
7. if the activity would impose undue burden on a remote machine or network, the measurements SHOULD NOT be performed without prior explicit permission 🙅‍♀️.

References 📖

• [1] Internet Activities Board, "Ethics and the Internet", RFC-1087, January 1989.
• [2] Holbrook, P., and J. Reynolds, (Eds.), "Site Security Handbook", RFC-1244, FYI-8, CICnet and USC Information Sciences Institute, July 1991.
• [3] Computer Emergency Response Team/Coordination Center (CERT/CC), Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA 15213-3890, Internet E-mail: cert@cert.sei.cmu.edu, Telephone: 412-268-7090 24-hour hotline.

Security Considerations 🔒

Okay this part is SERIOUS bestie 😭. The body of this memo does discuss security issues related to network measurement. The big one is the potential confusion between benign measurement and hostile security attacks, so please keep that in mind every time you run an experiment.

Author's Address 🖊️

Vinton G. Cerf
Chair of the IAB
Corporation for National Research Initiatives
1895 Preston White Drive, Suite 100
Reston, VA 22091

1-703-620-8990

VCerf@NRI.RESTON.VA.US

That's the whole RFC, bestie! 🌈💖 Measure responsibly and be the main character of good internet citizenship 👑🫶