Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04

Hi Med, Meiling,

>Med
Thank you for reviewing it carefully.

>>It seems that the same “start-time” is used in many example. Please check that to see if more realistic examples (with distinct time starts) can be considered.
OK. I will consider it.

>>The draft has some notes, e.g., “[Note: An example of total ..”. I understand that some examples are under preparation.
I'm preparing it for 08.

>>The latest version removed some attributes such as “src_ip”, but I still see “dst-ip”. You can clarify the meaning/type of this attribute.
OK. I will clarify it.

>Meiling
Thank you for updating the draft.

>>3.1.2. Optimal DMS Selection for Mitigation
>>The selected algorithm can be based on different implementations, for example, the available capacity of the DMSes is required to be greater than the peak value, then calculate the average value and select the DMS whose available capacity is closest to the average traffic flow.
I can't understand how the average value can be calculated based on
"low-percentile-g", "mid-percentile-g", "high-percentile-g", "peak-g"
and "current-g".  In addition, I can't understand why it is effective
to select the DMS whose available capacity is closest to the average
traffic flow.

How about the simple description like below?
-------
For example, the simple algorithm of the selection is to choose a DMS
whose available capacity is greater than the "peak-g".
-------

>>3.1.3. Best-path Selection for Redirection
>> For example, The orchestrator know the bandwidth of each link, under the condition that the link is reachable according to the destination address, then based on the traffic limitation and the total traffic should not  exceed the limit of each link segment.

How about the simple description like below?
-------
For example, the simple algorithm of the selection is to choose a path
whose available capacity is greater than the "peak-g".
-------

>>3.1.4. Short but Extreme Volumetric Attack Mitigation
>>Network management system as DOTs client pass the total pipe capacity to administrative system as DOTs server. Consistent with the draft-ietf-dots-telemetry section 7.2.
Can you write an example of the message body?

Thanks,
Yuhei

2022年2月16日(水) 18:24 Meiling Chen <chenmeiling@chinamobile.com>:
>
> Hi Med,
> Thank you, the remaining yuuhei will be updated on Friday.
>
> Best,
> Meiling
>
>
> From: mohamed.boucadair@orange.com
> Date: 2022-02-15 21:02
> To: Meiling Chen; H Y; dots
> CC: dots-chairs; Valery Smyslov; draft-ietf-dots-telemetry-use-cases@ietf.org
> Subject: RE: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
>
> Hi Meiling, all,
>
>
>
> Thank you for these updates.
>
>
>
> It seems that the same “start-time” is used in many example. Please check that to see if more realistic examples (with distinct time starts) can be considered.
>
>
>
> The draft has some notes, e.g., “[Note: An example of total ..”. I understand that some examples are under preparation.
>
>
>
> The latest version removed some attributes such as “src_ip”, but I still see “dst-ip”. You can clarify the meaning/type of this attribute.
>
>
>
> Thank you.
>
>
>
> Cheers,
>
> Med
>
>
>
> De : Meiling Chen <chenmeiling@chinamobile.com>
> Envoyé : mardi 15 février 2022 08:27
> À : H Y <yuuhei.hayashi@gmail.com>; BOUCADAIR Mohamed INNOV/NET <mohamed.boucadair@orange.com>; dots <dots@ietf.org>
> Cc : dots-chairs <dots-chairs@ietf.org>; Valery Smyslov <valery@smyslov.net>; draft-ietf-dots-telemetry-use-cases@ietf.org
> Objet : Re: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
>
>
>
> Hi all,
>
> Thank you for Med's comments, I have updated the draft to 07.
>
>
>
> Name: draft-ietf-dots-telemetry-use-cases
>
> Revision: 07
>
> Title: Use Cases for DDoS Open Threat Signaling (DOTS) Telemetry
>
> Document date: 2022-02-15
>
> Group: dots
>
> Pages: 27
>
> URL: https://www.ietf.org/archive/id/draft-ietf-dots-telemetry-use-cases-07.txt
>
> Status: https://datatracker.ietf.org/doc/draft-ietf-dots-telemetry-use-cases/
>
> Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-dots-telemetry-use-cases
>
> Diff: https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-telemetry-use-cases-07
>
>
>
> From: H Y
>
> Date: 2022-02-11 16:00
>
> To: Mohamed Boucadair; dots@ietf.org
>
> CC: dots-chairs@ietf.org; Valery Smyslov; draft-ietf-dots-telemetry-use-cases@ietf.org
>
> Subject: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
>
> Hi Med, All,
>
>
>
> I updated the draft and submitted it as 06.
>
>
>
> >You may consider removing them but add some text to recall the attack mapping over the data channel.
>
> I removed the "attack-description" in signal channel but add some
>
> mapping in data channel.
>
>
>
> Thanks,
>
> Yuhei
>
>
>
> 2022年2月11日(金) 16:40 H Y <yuuhei.hayashi@gmail.com>:
>
> >
>
> > Hi Med,
>
> >
>
> > I got it. I misunderstood the way to use "attack-description".
>
> >
>
> > >You may consider removing them but add some text to recall the attack mapping over the data channel.
>
> > I will remove the "attack-description".
>
> >
>
> > Thanks,
>
> > Yuhei
>
> >
>
> > 2022年2月11日(金) 15:49 <mohamed.boucadair@orange.com>:
>
> > >
>
> > > Hi Yuhei,
>
> > >
>
> > > One quick comment about:
>
> > >
>
> > > ==
>
> > >             "attack-description": "DNS amplification Attack: This attack is a type of reflection attack in which attackers spoofes a target's IP address. The attackers abuses vulnerbilities in DNS servers to turn small queries into larger payloads."
>
> > > ==
>
> > >
>
> > > and
>
> > >
>
> > > ==
>
> > >             "attack-description":"NTP amplification Attack: This attack is a type of reflection attack in which attackers spoofes a target's IP address. The attackers abuses vulnerbilities in NTP servers to turn small queries into larger payloads."
>
> > > ==
>
> > >
>
> > > Please note that the telemetry spec says the following:
>
> > >
>
> > >    When conveying attack details in DOTS telemetry messages (Sections
>
> > >    8.2, 8.3, and 9), DOTS agents MUST NOT include the 'attack-
>
> > >    description' attribute unless the corresponding attack mapping
>
> > >    details were not previously shared with the peer DOTS agent.
>
> > >
>
> > > So, the text should explain why "attack-description" attributes are present in the example.
>
> > >
>
> > > You may consider removing them but add some text to recall the attack mapping over the data channel.
>
> > >
>
> > > Thank you.
>
> > >
>
> > > Cheers,
>
> > > Med
>
> > >
>
> > > > -----Message d'origine-----
>
> > > > De : Dots <dots-bounces@ietf.org> De la part de H Y
>
> > > > Envoyé : vendredi 11 février 2022 05:16
>
> > > > À : dots@ietf.org
>
> > > > Cc : dots-chairs@ietf.org; Valery Smyslov <valery@smyslov.net>;
>
> > > > BOUCADAIR Mohamed INNOV/NET <mohamed.boucadair@orange.com>; draft-ietf-
>
> > > > dots-telemetry-use-cases@ietf.org
>
> > > > Objet : Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
>
> > > >
>
> > > > Hi all,
>
> > > >
>
> > > > We modified some nits and upload as 05. We will add some description to
>
> > > > clarify our use cases.
>
> > > >
>
> > > > Comments are welcome.
>
> > > >
>
> > > > Thanks,
>
> > > > Yuhei
>
> > > >
>
> > > > 2022年2月9日(水) 23:34 H Y <yuuhei.hayashi@gmail.com>:
>
> > > > >
>
> > > > > Hi Med,
>
> > > > >
>
> > > > > Thank you for your comments and suggestions.
>
> > > > >
>
> > > > > I will revise the draft in a few days.
>
> > > > >
>
> > > > > Thanks,
>
> > > > > Yuhei
>
> > > > >
>
> > > > > 2022年2月9日(水) 22:59 <mohamed.boucadair@orange.com>:
>
> > > > > >
>
> > > > > > Hi Valery, all,
>
> > > > > >
>
> > > > > > I support advancing this document, but I think a revised version is
>
> > > > needed.
>
> > > > > >
>
> > > > > > FWIW, some comments and suggestions can be found at:
>
> > > > > > * pdf:
>
> > > > > > https://raw.githubusercontent.com/boucadair/IETF-Drafts-Reviews/mast
>
> > > > > > er/draft-ietf-dots-telemetry-use-cases-04-rev%20Med.pdf
>
> > > > > > * doc:
>
> > > > > > https://github.com/boucadair/IETF-Drafts-Reviews/raw/master/draft-ie
>
> > > > > > tf-dots-telemetry-use-cases-04-rev%20Med.doc
>
> > > > > >
>
> > > > > > Cheers,
>
> > > > > > Med
>
> > > > > >
>
> > > > > > > -----Message d'origine-----
>
> > > > > > > De : Dots <dots-bounces@ietf.org> De la part de Valery Smyslov
>
> > > > > > > Envoyé : mercredi 9 février 2022 12:28 À : dots@ietf.org Cc :
>
> > > > > > > dots-chairs@ietf.org; draft-ietf-dots-telemetry-use-cases@ietf.org
>
> > > > > > > Objet : [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
>
> > > > > > >
>
> > > > > > > Hi,
>
> > > > > > >
>
> > > > > > > this message starts a two-week working group last call for
>
> > > > > > > draft-ietf- dots-telemetry-use-cases-04.
>
> > > > > > > The WGLC will end on Thursday, February 24. Please, review the
>
> > > > > > > draft and send your comments to the mailing list.
>
> > > > > > >
>
> > > > > > > Regards,
>
> > > > > > > Frank & Valery.
>
> > > > > > >
>
> > > > > > > _______________________________________________
>
> > > > > > > Dots mailing list
>
> > > > > > > Dots@ietf.org
>
> > > > > > > https://www.ietf.org/mailman/listinfo/dots
>
> > > > > >
>
> > > > > > ____________________________________________________________________
>
> > > > > > _____________________________________________________
>
> > > > > >
>
> > > > > > Ce message et ses pieces jointes peuvent contenir des informations
>
> > > > > > confidentielles ou privilegiees et ne doivent donc pas etre
>
> > > > > > diffuses, exploites ou copies sans autorisation. Si vous avez recu
>
> > > > > > ce message par erreur, veuillez le signaler a l'expediteur et le
>
> > > > detruire ainsi que les pieces jointes. Les messages electroniques etant
>
> > > > susceptibles d'alteration, Orange decline toute responsabilite si ce
>
> > > > message a ete altere, deforme ou falsifie. Merci.
>
> > > > > >
>
> > > > > > This message and its attachments may contain confidential or
>
> > > > > > privileged information that may be protected by law; they should not
>
> > > > be distributed, used or copied without authorisation.
>
> > > > > > If you have received this email in error, please notify the sender
>
> > > > and delete this message and its attachments.
>
> > > > > > As emails may be altered, Orange is not liable for messages that
>
> > > > have been modified, changed or falsified.
>
> > > > > > Thank you.
>
> > > > > >
>
> > > > >
>
> > > > >
>
> > > > > --
>
> > > > > ----------------------------------
>
> > > > > Yuuhei HAYASHI
>
> > > > > 08065300884
>
> > > > > yuuhei.hayashi@gmail.com
>
> > > > > iehuuy_0220@docomo.ne.jp
>
> > > > > ----------------------------------
>
> > > >
>
> > > >
>
> > > >
>
> > > > --
>
> > > > ----------------------------------
>
> > > > Yuuhei HAYASHI
>
> > > > 08065300884
>
> > > > yuuhei.hayashi@gmail.com
>
> > > > iehuuy_0220@docomo.ne.jp
>
> > > > ----------------------------------
>
> > >
>
> > > _________________________________________________________________________________________________________________________
>
> > >
>
> > > Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
>
> > > pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
>
> > > a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
>
> > > Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
>
> > >
>
> > > This message and its attachments may contain confidential or privileged information that may be protected by law;
>
> > > they should not be distributed, used or copied without authorisation.
>
> > > If you have received this email in error, please notify the sender and delete this message and its attachments.
>
> > > As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
>
> > > Thank you.
>
> > >
>
> >
>
> >
>
> > --
>
> > ----------------------------------
>
> > Yuuhei HAYASHI
>
> > 08065300884
>
> > yuuhei.hayashi@gmail.com
>
> > iehuuy_0220@docomo.ne.jp
>
> > ----------------------------------
>
>
>
>
>
>
>
> --
>
> ----------------------------------
>
> Yuuhei HAYASHI
>
> 08065300884
>
> yuuhei.hayashi@gmail.com
>
> iehuuy_0220@docomo.ne.jp
>
> ----------------------------------
>
>
>
>
>
> _______________________________________________
>
> Dots mailing list
>
> Dots@ietf.org
>
> https://www.ietf.org/mailman/listinfo/dots
>
> _________________________________________________________________________________________________________________________
> Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
> pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
> a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
> Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
> This message and its attachments may contain confidential or privileged information that may be protected by law;
> they should not be distributed, used or copied without authorisation.
> If you have received this email in error, please notify the sender and delete this message and its attachments.
> As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
> Thank you.

-- 
----------------------------------
Yuuhei HAYASHI
08065300884
yuuhei.hayashi@gmail.com
iehuuy_0220@docomo.ne.jp
----------------------------------