Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27F06130FB1; Tue, 5 Mar 2019 00:00:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nttv6.jp Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pOF66HU5GLSk; Tue, 5 Mar 2019 00:00:46 -0800 (PST) Received: from guri.nttv6.jp (guri.nttv6.jp [IPv6:2402:c800:ff06:136::140]) by ietfa.amsl.com (Postfix) with ESMTP id B9333130FD1; Tue, 5 Mar 2019 00:00:42 -0800 (PST) Received: from z.nttv6.jp (z.nttv6.jp [IPv6:2402:c800:ff06:6::f]) by guri.nttv6.jp (NTTv6MTA) with ESMTP id 6B00625F6BE; Tue, 5 Mar 2019 17:00:40 +0900 (JST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nttv6.jp; s=20180820; t=1551772840; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YSae3FkfDgi78hRhSjDPmkQs3oQaXNdigpkLpqkC6p0=; b=Ey69gFtuVgMmrFhuBHNv+e7uIuaFh/4pZh07jymUKFJxSTQk+6jqICj1v+fF2iPYtCXL01 cCD0KOzLvemCGV9LPnqJvKJ/3W9SO9lPraeeRHNNHkwbxbJxSH4erRNtkdMNvxjmStpCq4 5TWfCuIyUyywMYWwa6RPIxchwd68zL4= Received: from macbook-pro-17.lv4.nttv6.jp (fujiko.nttv6.jp [IPv6:2402:c800:ff06:136::141]) by z.nttv6.jp (NTTv6MTA) with ESMTP id 60E62759007; Tue, 5 Mar 2019 17:00:40 +0900 (JST) To: "Xialiang (Frank, Network Standard & Patent Dept)" , "draft-nishizuka-dots-signal-control-filtering.authors@ietf.org" Cc: "dots@ietf.org" References: From: kaname nishizuka Message-ID: <21e92c8d-8df0-576a-db08-3163c74bba59@nttv6.jp> Date: Tue, 5 Mar 2019 17:00:44 +0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A41A41F03D1B21A77ECA8C41" Content-Language: en-US Authentication-Results: guri.nttv6.jp; spf=pass smtp.mailfrom=kaname@nttv6.jp Archived-At: Subject: Re: [Dots] Hi, authors. 3 comments: X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2019 08:00:48 -0000 This is a multi-part message in MIME format. --------------A41A41F03D1B21A77ECA8C41 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Hi Frank, On 2019/03/05 15:26, Xialiang (Frank, Network Standard & Patent Dept) wrote: > > Hi authors, > > I have 3 general comments as below: > > 1.Can you clarify the DOTS server administrative domain a little bit? What is the goal we define it? > We'll clarify it and update the draft. > 2.Will this document open a door to make signal channel to cover the functions of data channel more and more? > > 3.I can accept the situation of changing the accept-list to the “deactivate” status, but is it a common use case we need to change a deny-list to the “immediate” status? > Regarding with 2 and 3, I can add one usecase to the draft. When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks). Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic. It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel. Then, it will send mitigation request to the DOTS server. This kind of procedure is really used by manual operation. Combination of ACL-based filtering and mitigation appliance is cost effective. The proposed draft (signal-control-filtering) enable automation of it. regards, Kaname > Thanks! > > B.R. > > Frank > --------------A41A41F03D1B21A77ECA8C41 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hi Frank,


On 2019/03/05 15:26, Xialiang (Frank, Network Standard & Patent Dept) wrote:

Hi authors,

I have 3 general comments as below:

1.       Can you clarify the DOTS server administrative domain a little bit? What is the goal we define it?

We'll clarify it and update the draft.

 

2.       Will this document open a door to make signal channel to cover the functions of data channel more and more?

 

3.       I can accept the situation of changing the accept-list to the “deactivate” status, but is it a common use case we need to change a deny-list to the “immediate” status?

Regarding with 2 and 3, I can add one usecase to the draft.
When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks).
Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic.
It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel.
Then, it will send mitigation request to the DOTS server.
This kind of procedure is really used by manual operation. Combination of ACL-based filtering and mitigation appliance is cost effective.
The proposed draft (signal-control-filtering) enable automation of it.

regards,
Kaname


 

Thanks!

 

 

B.R.

Frank


--------------A41A41F03D1B21A77ECA8C41--