[Dots] 答复: Hi, authors. 3 comments:

["Xialiang (Frank, Network Standard & Patent Dept)" <[e-mail]>]

Hi Med,
Thanks for the clarification, we are on the same page now.

B.R.
Frank

发件人: [e-mail] [mailto:[e-mail]]
发送时间: 2019年3月5日 18:30
收件人: kaname nishizuka <[e-mail]>; Xialiang (Frank, Network Standard & Patent Dept) <[e-mail]>; [e-mail]
抄送: [e-mail]
主题: RE: [Dots] Hi, authors. 3 comments:

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

De : Dots [mailto:[e-mail]] De la part de kaname nishizuka
Envoyé : mardi 5 mars 2019 09:01
À : Xialiang (Frank, Network Standard & Patent Dept); [e-mail]<mailto:[e-mail]>
Cc : [e-mail]<mailto:[e-mail]>
Objet : Re: [Dots] Hi, authors. 3 comments:

Hi Frank,
On 2019/03/05 15:26, Xialiang (Frank, Network Standard & Patent Dept) wrote:
Hi authors,
I have 3 general comments as below:

1.       Can you clarify the DOTS server administrative domain a little bit? What is the goal we define it?
We'll clarify it and update the draft.


[Med] This is what is called “DOTS server domain” in DOTS drafts. The notion of “administrative domain” is already used/discussed in the arch I-D.



2.       Will this document open a door to make signal channel to cover the functions of data channel more and more?

[Med] No. We do already have this text:



   A DOTS client MUST NOT use the filtering control over DOTS signal

   channel if no attack (mitigation) is active; such requests MUST be

   discarded by the DOTS server with 4.00 (Bad Request).  By default,

   ACL-related operations are achieved using the DOTS data channel

   [I-D.ietf-dots-data-channel<https://tools.ietf.org/html/draft-nishizuka-dots-signal-control-filtering-04#ref-I-D.ietf-dots-data-channel>] when no attack is ongoing.



The draft focuses only on tweaking the status of **existing** filters.



3.       I can accept the situation of changing the accept-list to the “deactivate” status, but is it a common use case we need to change a deny-list to the “immediate” status?
Regarding with 2 and 3, I can add one usecase to the draft.
When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks).
Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic.
It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel.
Then, it will send mitigation request to the DOTS server.
This kind of procedure is really used by manual operation. Combination of ACL-based filtering and mitigation appliance is cost effective.
The proposed draft (signal-control-filtering) enable automation of it.

regards,
Kaname




Thanks!


B.R.
Frank