Re: [77attendees] Bar BoF: ip traceback

Yoav Nir <ynir@checkpoint.com> Thu, 25 March 2010 16:32 UTC

Return-Path: <ynir@checkpoint.com>
X-Original-To: 77attendees@core3.amsl.com
Delivered-To: 77attendees@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97A853A6982 for <77attendees@core3.amsl.com>; Thu, 25 Mar 2010 09:32:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.577
X-Spam-Level:
X-Spam-Status: No, score=-1.577 tagged_above=-999 required=5 tests=[AWL=0.892, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tH6bcqIU9hOq for <77attendees@core3.amsl.com>; Thu, 25 Mar 2010 09:32:13 -0700 (PDT)
Received: from michael.checkpoint.com (michael.checkpoint.com [194.29.32.68]) by core3.amsl.com (Postfix) with ESMTP id 0CD1A3A692B for <77attendees@ietf.org>; Thu, 25 Mar 2010 09:32:12 -0700 (PDT)
Received: from il-ex01.ad.checkpoint.com (il-ex01.checkpoint.com [194.29.34.26]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id o2PGWVsd007170; Thu, 25 Mar 2010 18:32:31 +0200 (IST)
X-CheckPoint: {4BAB8F50-1-1211DC2-2FFFF}
Received: from il-ex01.ad.checkpoint.com ([126.0.0.2]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Thu, 25 Mar 2010 18:32:53 +0200
From: Yoav Nir <ynir@checkpoint.com>
To: Jari Arkko <jari.arkko@piuha.net>
Date: Thu, 25 Mar 2010 18:32:28 +0200
Thread-Topic: [77attendees] Bar BoF: ip traceback
Thread-Index: AcrMONBMsgMAwUNQQneZmv8bpMgEhQ==
Message-ID: <8133D17D-D9B6-40A6-AE9B-80BF90A5223D@checkpoint.com>
References: <4BA8BCE3.5020309@is.naist.jp> <4BA95B6A.5040707@is.naist.jp> <4BAB0464.2010307@is.naist.jp> <4BAB7A4D.7070904@piuha.net>
In-Reply-To: <4BAB7A4D.7070904@piuha.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "77attendees@ietf.org" <77attendees@ietf.org>
Subject: Re: [77attendees] Bar BoF: ip traceback
X-BeenThere: 77attendees@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <77attendees.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/77attendees>, <mailto:77attendees-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/77attendees>
List-Post: <mailto:77attendees@ietf.org>
List-Help: <mailto:77attendees-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/77attendees>, <mailto:77attendees-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Mar 2010 16:32:14 -0000

I don't think anyone was taking minutes.

The just made the two presentations (traceback experiment and using this to identify BOTs based on their DNS requests). Both presentations are on the web page.

There were no ADs in the room. AFAIK no WG chairs either, which is somewhat a shame, so no conclusions either.

My own, personal conclusion was that this was interesting and has potential. There *is* work to be done (two different versions that they wrote did not interoperate properly) and since success requires wide adoption by ISPs, I believe that the IETF is probably the right place for this.  But these are just my personal opinions, and I have no idea if we can get enough people to actually work on this.

I suggest that the correct next step is for the authors to contact one or more ADs. Though this seems directly related to security, the fact that this would be a protocol that would run between AS edge routers, it could fall to other areas as well. So I think the next step should be scheduling a BoF for next IETF, and making sure that the right people are there.

On Mar 25, 2010, at 7:59 AM, Jari Arkko wrote:

> Are there minutes, or better yet, a conclusion?
> 
> Jari
> 
> Hiroaki Hazeyama kirjoitti:
>> We putted our presentation materials of the ip traceback bar bof on
>> https://www.telecom-isac.jp/tb/index_e.html
>> 
>> Thanks,
>> H. Hazeyama
>> 
>> (2010/03/24 9:23), Hiroaki Hazeyama wrote:
>>> the location of the ip traceback bar bof is Carmel.
>>> 
>>> 
>>> thanks,
>>> H. Hazeyama
>>> 
>>> 
>>> (2010/03/23 22:06), Hiroaki Hazeyama wrote:
>>>> Hi,
>>>> 
>>>> We will have a IP traceback bar bof
>>>> 
>>>> Day: Wednesday March 24
>>>> Time: 11:45,
>>>> location: TBD
>>>> 
>>>> Welcome to come for a discussion and suggestions and comments are 
>>>> highly desired.
>>>> 
>>>> 
>>>> The agenda of our Bar BOF is as follows;
>>>> 
>>>> - introduction of the traceback architecture of the field trial in 
>>>> Japan
>>>> (10 min.)
>>>> 
>>>> http://www.ietf.org/internet-drafts/draft-hazeyama-traceback-field-trial-00.txt 
>>>> 
>>>> 
>>>> - evaluation results of the tracback field trial in Japan (10 min.)
>>>> 
>>>> - DNS log-based traceback (10 min.)
>>>> 
>>>> 
>>>> Best regards,
>>>> 
>>>> H. Hazeyama
>>>> 
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> 77attendees mailing list
>>>> 77attendees@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/77attendees
>>> 
>>> _______________________________________________
>>> 77attendees mailing list
>>> 77attendees@ietf.org
>>> https://www.ietf.org/mailman/listinfo/77attendees
>> 
>> _______________________________________________
>> 77attendees mailing list
>> 77attendees@ietf.org
>> https://www.ietf.org/mailman/listinfo/77attendees
>> 
> 
> _______________________________________________
> 77attendees mailing list
> 77attendees@ietf.org
> https://www.ietf.org/mailman/listinfo/77attendees
> 
> Scanned by Check Point Total Security Gateway.