Re: [77attendees] Bar BoF: ip traceback

Yoav Nir <ynir@checkpoint.com> Thu, 25 March 2010 17:42 UTC

Return-Path: <ynir@checkpoint.com>
X-Original-To: 77attendees@core3.amsl.com
Delivered-To: 77attendees@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF5623A6898 for <77attendees@core3.amsl.com>; Thu, 25 Mar 2010 10:42:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.366
X-Spam-Level:
X-Spam-Status: No, score=-0.366 tagged_above=-999 required=5 tests=[AWL=-0.497, BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2resifzph-6S for <77attendees@core3.amsl.com>; Thu, 25 Mar 2010 10:42:34 -0700 (PDT)
Received: from michael.checkpoint.com (michael.checkpoint.com [194.29.32.68]) by core3.amsl.com (Postfix) with ESMTP id 4B1C03A6B8A for <77attendees@ietf.org>; Thu, 25 Mar 2010 10:40:16 -0700 (PDT)
Received: from il-ex01.ad.checkpoint.com (il-ex01.checkpoint.com [194.29.34.26]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id o2PHeasd016790; Thu, 25 Mar 2010 19:40:36 +0200 (IST)
X-CheckPoint: {4BAB9F44-0-1211DC2-2FFFF}
Received: from il-ex01.ad.checkpoint.com ([126.0.0.2]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Thu, 25 Mar 2010 19:40:57 +0200
From: Yoav Nir <ynir@checkpoint.com>
To: Jari Arkko <jari.arkko@piuha.net>
Date: Thu, 25 Mar 2010 19:40:32 +0200
Thread-Topic: [77attendees] Bar BoF: ip traceback
Thread-Index: AcrMQlLdQwJDndqQT2uWxoFP0q6Z0w==
Message-ID: <C3960BE0-9093-4863-8AAE-62BEAB197E6D@checkpoint.com>
References: <4BA8BCE3.5020309@is.naist.jp> <4BA95B6A.5040707@is.naist.jp> <4BAB0464.2010307@is.naist.jp> <4BAB7A4D.7070904@piuha.net> <8133D17D-D9B6-40A6-AE9B-80BF90A5223D@checkpoint.com> <4BAB936E.6010307@piuha.net>
In-Reply-To: <4BAB936E.6010307@piuha.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "77attendees@ietf.org" <77attendees@ietf.org>
Subject: Re: [77attendees] Bar BoF: ip traceback
X-BeenThere: 77attendees@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <77attendees.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/77attendees>, <mailto:77attendees-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/77attendees>
List-Post: <mailto:77attendees@ietf.org>
List-Help: <mailto:77attendees-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/77attendees>, <mailto:77attendees-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Mar 2010 17:42:35 -0000

On Mar 25, 2010, at 9:46 AM, Jari Arkko wrote:
>> My own, personal conclusion was that this was interesting and has potential. There *is* work to be done (two different versions that they wrote did not interoperate properly) and since success requires wide adoption by ISPs, I believe that the IETF is probably the right place for this.  But these are just my personal opinions, and I have no idea if we can get enough people to actually work on this.
>> 
>> I suggest that the correct next step is for the authors to contact one or more ADs. Though this seems directly related to security, the fact that this would be a protocol that would run between AS edge routers, it could fall to other areas as well. So I think the next step should be scheduling a BoF for next IETF, and making sure that the right people are there.
>>   
> 
> The question in my mind is: is the world interested in this technology. Previous IETF efforts in traceback failed IMO due to lack of operator/vendor interest. We should not create new efforts unless that interest surges again. Is it surging, and if so, why?
> 
> Jari

We've heard that attack packets now take up a significant portion of the traffic on the Internet. Specifically members of bot-nets create congestion for ISPs. There is a chance that now they would be more interested in deploying traceback technology than in the past, when Internet attacks were a problem only for the end users.

We have at least anecdotal evidence of such interest, in that 15 Japanese ISPs have agreed to participate in this experiment on their production networks. This must count for something.

Anyway, a BoF with the relevant people present is, IMO, the best way to gauge the interest.

So the next steps are to set up a BoF for IETF 78, and to set up a mailing list, where hopefully we can hear from the operators.