Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-telemetry-00.txt

[<[e-mail]>]

Hi Tiru, 

These questions are valid ones when it comes to decide which mitigation actions to apply. Nevertheless, the source information is part of the characterization of an attack at given time. This does not mean that we necessarily rely on it to mitigate, but this is not excluded either.  

The source information can be included in the notification use case already described by Kaname in this thread, or if the mitigator is enforcing policies based on the source information (because of a local knowledge of an attack) but reaches a limit, it can delegate the policy to a L3 orchestrator (Yuhei case). 

Cheers,
Med

> -----Message d'origine-----
> De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
> Envoyé : mercredi 24 juillet 2019 15:35
> À : H Y; BOUCADAIR Mohamed TGI/OLN
> Cc : tirumal reddy; [e-mail]
> Objet : RE: [Dots] Fwd: New Version Notification for draft-reddy-dots-
> telemetry-00.txt
> 
> Hi Yuhei,
> 
> What is stopping the attacker to frequently change the IP address
> (especially with IPv6) ?
> What kind of attack traffic is generated by the top talkers and what
> happens if the top talkers are spoofed IP addresses (e.g. amplification
> attack) ?
> 
> Cheers,
> -Tiru
> 
> > -----Original Message-----
> > From: H Y <[e-mail]>
> > Sent: Wednesday, July 24, 2019 6:57 PM
> > To: Mohamed Boucadair <[e-mail]>
> > Cc: Konda, Tirumaleswar Reddy <[e-mail]>;
> > tirumal reddy <[e-mail]>; [e-mail]
> > Subject: Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-
> > telemetry-00.txt
> >
> >
> >
> > Hi Med,
> >
> > > [Med] Yes. My point is if one has to return a list of top-talkers in
> terms of
> > pps, another list of top-talkers in terms of second_criteria, or other
> > information relying on source-prefix dedicated attributes will be needed
> > because this cannot be inferred from the current source-prefix
> attribute.
> > [hayashi] +1. This top-talker information is helpful for the
> orchestrator to
> > decide which attack traffic should be blocked preferentially in network.
> The
> > criteria information is also needed.
> >
> > Thanks,
> > Yuhei
> >
> > 2019年7月24日(水) 8:56 <[e-mail]>:
> > >
> > > Re-,
> > >
> > > Please see inline.
> > >
> > > Cheers,
> > > Med
> > >
> > > > -----Message d'origine-----
> > > > De : Konda, Tirumaleswar Reddy
> > > > [mailto:[e-mail]]
> > > > Envoyé : mercredi 24 juillet 2019 14:45 À : BOUCADAIR Mohamed
> > > > TGI/OLN; H Y; tirumal reddy Cc : [e-mail] Objet : RE: [Dots]
> > > > Fwd: New Version Notification for draft-reddy-dots- telemetry-00.txt
> > > >
> > > > > -----Original Message-----
> > > > > From: [e-mail]
> > <[e-mail]>
> > > > > Sent: Wednesday, July 24, 2019 6:02 PM
> > > > > To: Konda, Tirumaleswar Reddy
> > > > > <[e-mail]>; H Y
> > > > > <[e-mail]>; tirumal reddy <[e-mail]>
> > > > > Cc: [e-mail]
> > > > > Subject: RE: [Dots] Fwd: New Version Notification for
> > > > > draft-reddy-dots- telemetry-00.txt
> > > > >
> > > > > This email originated from outside of the organization. Do not
> > > > > click
> > > > links or
> > > > > open attachments unless you recognize the sender and know the
> > > > > content is safe.
> > > > >
> > > > > Hi Tiru,
> > > > >
> > > > > That’s true...but fragmentation is a general issue each time we
> > > > > need to supply more telemetry information in the signal channel.
> > > > > As already
> > > > noted in
> > > > > the draft, we will need to figure out when it is better to provide
> > > > > some telemetry information using data channel.
> > > >
> > > > Yes, normal traffic baseline attributes can be conveyed in the DOTS
> > > > data channel and traffic from top talkers can also be
> > > > blocked/rate-limited using the DOTS data channel during peace time.
> > > >
> > > > >
> > > > > BTW, "top talker" can already be supplied using source-prefix
> attribute.
> > > > > Whether top-talker needs to be defined as a separated attribute,
> > > > > but structured as a list of source-prefixes is a design details
> > > > > (if the WG
> > > > agrees to
> > > > > include it in the telemetry information).
> > > >
> > > > Source-prefix is already a list/array.
> > >
> > > [Med] Yes. My point is if one has to return a list of top-talkers in
> terms of
> > pps, another list of top-talkers in terms of second_criteria, or other
> > information relying on source-prefix dedicated attributes will be needed
> > because this cannot be inferred from the current source-prefix
> attribute.
> > >
> > > >
> > > > >
> > > > > Anyway, let's continue collecting candidate telemetry information
> > > > > and
> > > > then
> > > > > make a selection in a second phase.
> > > >
> > > > Sure.
> > > >
> > > > Cheers,
> > > > -Tiru
> > > >
> > > > >
> > > > > Cheers,
> > > > > Med
> > > > >
> > > > > > -----Message d'origine-----
> > > > > > De : Dots [mailto:[e-mail]] De la part de Konda,
> > > > > > Tirumaleswar Reddy Envoyé : mercredi 24 juillet 2019 14:18 À : H
> > > > > > Y; tirumal reddy Cc : [e-mail] Objet : Re: [Dots] Fwd: New
> > > > > > Version Notification for draft-reddy-dots- telemetry-00.txt
> > > > > >
> > > > > > Hi Yuhei,
> > > > > >
> > > > > > Thanks for the support. The problem is fragmentation of the DOTS
> > > > > > telemetry message, DOTS Telemetry is sent over the DOTS signal
> > > > > > channel using UDP and the message size cannot exceed PMTU.
> > > > > >
> > > > > > Cheers,
> > > > > > -Tiru
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: Dots <[e-mail]> On Behalf Of H Y
> > > > > > > Sent: Tuesday, July 23, 2019 5:28 PM
> > > > > > > To: tirumal reddy <[e-mail]>
> > > > > > > Cc: [e-mail]
> > > > > > > Subject: Re: [Dots] Fwd: New Version Notification for
> > > > > > > draft-reddy-dots- telemetry-00.txt
> > > > > > >
> > > > > > > This email originated from outside of the organization. Do not
> > > > > > > click
> > > > > > links or
> > > > > > > open attachments unless you recognize the sender and know the
> > > > > > > content is safe.
> > > > > > >
> > > > > > > Hi Tiru,
> > > > > > >
> > > > > > > I read the draft and I also support this draft.
> > > > > > > Sending detail information about attack traffic helps my dms
> > > > > > > offload
> > > > > > scenario
> > > > > > > because the orchestrator can decide what to do based on the
> > > > > > > detail information.
> > > > > > >
> > > > > > > IMO, "top talker" attribute defined in my previous draft is
> > > > > > > also
> > > > > > feasible to
> > > > > > > send and effective to mitigate attack correctly.
> > > > > > > https://datatracker.ietf.org/doc/draft-h-dots-mitigation-offlo
> > > > > > > ad-
> > > > > > expansion/
> > > > > > > What do you think about including the top talker attribute to
> > > > > > > the
> > > > > > telemetry?
> > > > > > >
> > > > > > > Thanks,
> > > > > > > Yuhei
> > > > > > >
> > > > > > > 2019年7月5日(金) 9:21 tirumal reddy <[e-mail]>:
> > > > > > > >
> > > > > > > > Hi all,
> > > > > > > >
> > > > > > > > https://tools.ietf.org/html/draft-reddy-dots-telemetry-00
> > > > > > > > aims to
> > > > > > enrich
> > > > > > > DOTS protocols with various telemetry attributes allowing
> > > > > > > optimal DDoS attack mitigation. This document specifies the
> > > > > > > normal traffic baseline
> > > > > > and
> > > > > > > attack traffic telemetry attributes a DOTS client can convey
> > > > > > > to its DOTS
> > > > > > server
> > > > > > > in the mitigation request, the mitigation status telemetry
> > > > > > > attributes a
> > > > > > DOTS
> > > > > > > server can communicate to a DOTS client, and the mitigation
> > > > > > > efficacy telemetry attributes a DOTS client can communicate to
> a
> > DOTS server.
> > > > > > The
> > > > > > > telemetry attributes can assist the mitigator to choose the
> > > > > > > DDoS
> > > > > > mitigation
> > > > > > > techniques and perform optimal DDoS attack mitigation.
> > > > > > > >
> > > > > > > > Comments, suggestions, and questions are more than welcome.
> > > > > > > >
> > > > > > > > Cheers,
> > > > > > > > -Tiru
> > > > > > > >
> > > > > > > > ---------- Forwarded message ---------
> > > > > > > > From: <[e-mail]>
> > > > > > > > Date: Fri, 5 Jul 2019 at 18:44
> > > > > > > > Subject: New Version Notification for
> > > > > > > > draft-reddy-dots-telemetry-00.txt
> > > > > > > > To: Tirumaleswar Reddy <[e-mail]>, Ehud Doron
> > > > > > > > <[e-mail]>, Mohamed Boucadair
> > > > > > > <[e-mail]>
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > A new version of I-D, draft-reddy-dots-telemetry-00.txt has
> > > > > > > > been successfully submitted by Tirumaleswar Reddy and posted
> > > > > > > > to the IETF repository.
> > > > > > > >
> > > > > > > > Name:           draft-reddy-dots-telemetry
> > > > > > > > Revision:       00
> > > > > > > > Title:          Distributed Denial-of-Service Open Threat
> > > > Signaling
> > > > > > (DOTS)
> > > > > > > Telemetry
> > > > > > > > Document date:  2019-07-05
> > > > > > > > Group:          Individual Submission
> > > > > > > > Pages:          13
> > > > > > > > URL:            https://www.ietf.org/internet-drafts/draft-
> reddy-
> > > > dots-
> > > > > > > telemetry-00.txt
> > > > > > > > Status:         https://datatracker.ietf.org/doc/draft-
> reddy-dots-
> > > > > > telemetry/
> > > > > > > > Htmlized:       https://tools.ietf.org/html/draft-reddy-
> dots-
> > > > > > telemetry-00
> > > > > > > > Htmlized:       https://datatracker.ietf.org/doc/html/draft-
> reddy-
> > > > > > dots-
> > > > > > > telemetry
> > > > > > > >
> > > > > > > >
> > > > > > > > Abstract:
> > > > > > > >    This document aims to enrich DOTS signal channel protocol
> with
> > > > > > > >    various telemetry attributes allowing optimal DDoS attack
> > > > > > mitigation.
> > > > > > > >    This document specifies the normal traffic baseline and
> attack
> > > > > > > >    traffic telemetry attributes a DOTS client can convey to
> > > > > > > > its
> > > > DOTS
> > > > > > > >    server in the mitigation request, the mitigation status
> > > > telemetry
> > > > > > > >    attributes a DOTS server can communicate to a DOTS
> > > > > > > > client, and
> > > > the
> > > > > > > >    mitigation efficacy telemetry attributes a DOTS client
> can
> > > > > > > >    communicate to a DOTS server.  The telemetry attributes
> > > > > > > > can
> > > > assist
> > > > > > > >    the mitigator to choose the DDoS mitigation techniques
> > > > > > > > and
> > > > perform
> > > > > > > >    optimal DDoS attack mitigation.
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > Please note that it may take a couple of minutes from the
> > > > > > > > time of submission until the htmlized version and diff are
> > > > > > > > available at
> > > > > > tools.ietf.org.
> > > > > > > >
> > > > > > > > The IETF Secretariat
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Dots mailing list
> > > > > > > > [e-mail]
> > > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > ----------------------------------
> > > > > > > Yuuhei HAYASHI
> > > > > > > 08065300884
> > > > > > > [e-mail]
> > > > > > > [e-mail]
> > > > > > > ----------------------------------
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Dots mailing list
> > > > > > > [e-mail]
> > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > > > _______________________________________________
> > > > > > Dots mailing list
> > > > > > [e-mail]
> > > > > > https://www.ietf.org/mailman/listinfo/dots
> >
> >
> >
> > --
> > ----------------------------------
> > Yuuhei HAYASHI
> > 08065300884
> > [e-mail]
> > [e-mail]
> > ----------------------------------