Re: [Dots] AD review of draft-ietf-dots-data-channel-25

[<[e-mail]>]

Hi Tiru, 

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
> Envoyé : vendredi 15 février 2019 12:06
> À : BOUCADAIR Mohamed TGI/OLN; Benjamin Kaduk
> Cc : [e-mail]; [e-mail]
> Objet : RE: AD review of draft-ietf-dots-data-channel-25
> 
> I am catching up with the discussion, couple of points:
> 
> 1)
>       *  If a network resource (DOTS client) detects a potential DDoS
>          attack from a set of IP addresses, the DOTS client informs its
>          servicing DOTS gateway of all suspect IP addresses that need to
>          be drop- or accept-listed for further investigation.
> 
> Comment> I don't see why suspect IP addresses will be accept-listed ?
>                     We may want to remove "or accept-listed" from the above
> line.
> 

[Med] Ack.  

> [Med] The dots client will know if its request is successfully delivered.
> When an attack is ongoing, the dots client should not use it data channel
> because it is likely to be perturbed.
> 
> Comment> If the HTTP response from the server did not reach the client
> because of a volumetric attack saturating the incoming the link, the DOTS
> client will not know
> whether the configuration is successfully updated or not. After the attack is
> mitigated, the client will have to re-establish the TLS session and retrieve
> the configuration to check if its last request was successfully applied or
> not before updating the configuration.
> 

[Med] Agree. Still, how the client syncs its config with the one maintained by the server is implementation-specific. A client can send a GET before and/or after a configuration change request, in regular intervals, after attack mitigation, etc.  

> Cheers,
> -Tiru