First cut at capabilities doc template

[George Jones <eludom@gmail.com>]

Merike and I have talked things over and I think we've got the split
between the operator practice survey doc and the individual
capabilities documents worked out in principal.   The Abstract
below is a swag at capturing the split.   Please review and comment.
I've recast one of the rfc3781 requirements as a capability to show
the style of the capabilities.   Note that there is no justification
with the capability other than to cite practices supported.
The threat model, attacks, justificaiton, etc will live in the
framework and survey docs (Merike has all the hard work !)

One we agree on the format/split, I think the individual capabilities
docs can flow pretty quickly.

---George

--------------------------------------cut
here----------------------------------------------

Abstract

   CITE-OPERATOR-SURVEY-RFC lists operator practices related to securing
   networks.  This document lists filtering capabilities needed to
   support those practices.

   Capabilities are defined without reference to specific technologies.
   This is done to leave room for deployment of new technologies that
   implement the capability.  Where current technology exists that
   implements the capability, it is cited in the "current
   implementations" subsections.

   CITE-OPERATOR-SURVEY-RFC defines the threat model, potential attacks
   and give justifications for each of the practices.  This document
   does not justify the need for capabilities other than to cite the
   practice(s) they support.

   Capabilities may or may not be requirements.  That is a local
   determination that must be made by each operator with reference to
   the policies that they must support.  It is hoped that this document,
   together with CITE-OPERATOR-SURVEY-RFC will assist operators in
   identifying their security capability requirements and communicating
   them clearly to vendors.

.
.
.

1.2.3 Ability to Display Filter Counters

   Capability.

      The device provides a mechanism to display filter counters.

   Practices Supported.

      *  Detecting Malicious Traffic (RFCxxxx Section 1.2.3)
      *  Profiling Malicious Traffic (RFCxxxx)Section 1.2.4)

   Current Implementations.

      *  CLI interface to display filter counters for individual
         fitlers.