Re: [Dots] draft-fu-dots-ipfix-extension revised into draft-fu-dots-ipfix-tcp-tracking

[Roland Dobbins <[e-mail]>]

On 13 Mar 2017, at 14:37, Zhenghui (Marvin) wrote:

> So, we’d like to hear from the WG, is that some pointers can be 
> given on the next step of the draft,

The draft belies a lack of understanding of how current IPFIX 
capabilities are utilized every day to detect, classify, and traceback 
DDoS attacks.  It makes factually incorrect statements such as 'not 
suitable for attack detection, and impractical suggestinos such as 
'connection sampling' which a) won't work on routers/layer-3 switches of 
any size and b) are unnecessary.

It is suggested that the authors of the draft gain operational 
experience using existing IPFIX implementations and IPFIX 
collection/analysis systems in order to fully understand the utility of 
IPFIX as presently defined as well as the full range of capabilities of 
IPFIX collection/analysis systems.  It would also be a good idea for the 
authors of the draft to understand the division of labor between IPFIX 
exporters and IPFIX collectors/analyzers, as well as the capabilities 
and limitations of hardware-based routing/switching platforms.

> We submitted this draft to DOTS because IPFIX WG had been closed

It is entirely possible to re-open the IPFIX WG, if it is deemed useful 
to do so.  The authors of the draft should contact the appropriate Area 
Director in order to discuss.

-----------------------------------
Roland Dobbins <[e-mail]>