Re: [Dots] WGLC for draft-dots-use-cases-19

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail]
> <[e-mail]>
> Sent: Tuesday, August 6, 2019 7:06 PM
> To: Konda, Tirumaleswar Reddy
> <[e-mail]>; Valery Smyslov
> <[e-mail]>; [e-mail]
> Cc: Xialiang (Frank, Network Standard & Patent Dept)
> <[e-mail]>
> Subject: RE: [Dots] WGLC for draft-dots-use-cases-19
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is
> safe.
> 
> Re-,
> 
> Please see inline.
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:[e-mail]]
> > Envoyé : mardi 6 août 2019 15:08
> > À : BOUCADAIR Mohamed TGI/OLN; Valery Smyslov; [e-mail] Cc :
> > Xialiang (Frank, Network Standard & Patent Dept) Objet : RE: [Dots]
> > WGLC for draft-dots-use-cases-19
> >
> ...
> > > > > [Med] The recursive case is not covered in the current text. I
> > > > > don't
> > > > think we
> > > > > need to elaborate on this further.
> > > >
> > > > I don't understand why recursive case should be excluded in the
> > > > current text ?
> > >
> > > [Med] Because the use-case draft does not cover this: It only covers
> > > the
> > case
> > > of an orchestrator talking to local routers.
> >
> > My question is why shouldn't the use case draft cover this ?
> 
> [Med] Isn't this captured with the following?
> 
>    o  DDoS Mitigation System (DMS): A system that performs DDoS
>       mitigation.  The DDoS Mitigation System may be composed by a
>       cluster of hardware and/or software resources, but could also
>       involve an orchestrator that may take decisions such as
>       outsourcing partial or more of the mitigation to another DDoS
> 
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ^^
>       Mitigation System.
> 
> And
> 
>    Another typical scenario for this use case is the relation between
>    DDoS Mitigation Service Providers forming an overlay of DMS.  When a
>    DDoS Mitigation Service Provider mitigating a DDoS attack reaches it
>    resources capacities, it may choose to delegate the DDoS Mitigation to
>    another DDoS Mitigation Service Provider.

I missed above text, Thanks.

> 
> >
> > >
> > > >
> > > > >
> > > > >  However If orchestrator is enforcing
> > > > > > filtering rules on routers, it should create the black-list
> > > > > > rules based on the non-spoofed attacker IP address and not use
> > > > > > the spoofed victim IP addresses.
> > > > > >
> > > > >
> > > > > [Med] Agree. Whether the check is done at the orchestrator or by
> > > > > the
> > > > DMS,
> > > > > is not a new concern. The DMS has to proceed with these checks,
> > anyway.
> > > > I
> > > > > fail to see what is NEW and SPECIFIC to the offload scenario.
> > > >
> > > > In this case the check has to be done by orchestrator when
> > > > enforcing black-list rules not to penalize the spoofed victim IP
> > > > addresses and should be discussed in the new use case.
> > >
> > > [Med] This requirement has to be followed by the DMS, anyway. This
> > > is
> > not a
> > > new issue, Tiru.
> >
> > No, sending attack information to the DOTS server is not covered in
> > any of the WG documents.
> >
> 
> [Med] The text is about "additional hints". This is all what DOTS is about :-)

Yes, but the NEW text is discussing conveying attack information for the first time and it needs more details.

> 
> > >
> > >  I don't see any other use case in
> > > > the specification discussing offload scenario with propagating the
> > > > attack information and I recommend updating the text discussing
> > > > the above scenarios.
> > >
> > > [Med] We don't have a similar text for the DMS case because
> > > mitigation
> > is
> > > out of scope. I'm expecting to follow the some rationale for the
> > offload.
> >
> > If mitigation is out of scope, remove the following line:
> > Then the orchestrator can take further actions like requesting
> > forwarding nodes such as routers to filter the traffic.
> 
> [Med] This sentence is similar to saying the "DMS starts mitigation" but with
> more contextualized information for a network orchestrator. The sentence
> uses "can", "like" which is fine for illustration purposes. As a reader, I prefer
> to leave it.

I suggest to add more details discussed in the thread. Anyways, will leave it to you and the authors to decide, and I am not objecting to progressing the draft 
without the proposed update.

Cheers,
-Tiru