Re: [Dots] Éric Vyncke's No Objection on draft-ietf-dots-telemetry-use-cases-14: (with COMMENT)

[Hayashi Yuhei <[e-mail]>]

Hi Eric,

Thank you for your comments. We updated the draft to address your comment.
Diff is here.
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-telemetry-use-cases-15

Please see inline.

2022年10月20日(木) 16:50 Eric Vyncke (evyncke) <[e-mail]>:
>
> Thank you, Med, this would indeed address my comment
>
> -éric
>
> On 20/10/2022, 09:32, "[e-mail]" <[e-mail]> wrote:
>
>     Hi Éric,
>
>     Please see one comment inline.
>
>     Cheers,
>     Med
>
>     > -----Message d'origine-----
>     > De : Dots <[e-mail]> De la part de Éric Vyncke via
>     > Datatracker
>     > Envoyé : jeudi 20 octobre 2022 09:11
>     > À : The IESG <[e-mail]>
>     > Cc : [e-mail]; dots-
>     > [e-mail]; [e-mail]; [e-mail];
>     > [e-mail]
>     > Objet : [Dots] Éric Vyncke's No Objection on draft-ietf-dots-
>     > telemetry-use-cases-14: (with COMMENT)
>     >
>     > Éric Vyncke has entered the following ballot position for
>     > draft-ietf-dots-telemetry-use-cases-14: No Objection
>     >
>     > When responding, please keep the subject line intact and reply to
>     > all email addresses included in the To and CC lines. (Feel free to
>     > cut this introductory paragraph, however.)
>     >
>     >
>     > Please refer to
>     > https://www.ietf.org/about/groups/iesg/statements/handling-ballot-
>     > positions/
>     > for more information about how to handle DISCUSS and COMMENT
>     > positions.
>     >
>     >
>     > The document, along with other ballot positions, can be found
>     > here:
>     > https://datatracker.ietf.org/doc/draft-ietf-dots-telemetry-use-
>     > cases/
>     >
>     >
>     >
>     > ------------------------------------------------------------------
>     > ----
>     > COMMENT:
>     > ------------------------------------------------------------------
>     > ----
>     >
>     >
>     > # Éric Vyncke, INT AD, comments for draft-ietf-shmoo-hackathon-07
>     > CC @evyncke
>     >
>     > Thank you for the work put into this document.
>     >
>     > Please find below some non-blocking COMMENT points (but replies
>     > would be
>     > appreciated even if only for my own education).
>     >
>     > Special thanks to Valery Smyslov for the shepherd's detailed
>     > write-up including
>     > the WG consensus *but* the justification of the intended status is
>     > missing.
>     >
>     > I hope that this review helps to improve the document,
>     >
>     > Regards,
>     >
>     > -éric
>     >
>     > ## COMMENTS
>     >
>     > ### Timing of the WG docs
>     >
>     > Like Alvaro wrote, it would have been nicer for the reviewer to
>     > have this
>     > document published before RFC 9244 ;-)
>     >
>     > ### Section 3.1.1 report
>     >
>     > `recently reported large DDoS attacks exceeded several Tbps`
>     > please provide an
>     > informative reference to this report.
>
>     [Med] A pointer to https://datatracker.ietf.org/meeting/108/materials/slides-108-saag-dots-overview-00 (slide 3) can be added. The prez includes embedded URLs.
[Yuhei]
Med, Thank you! We added the reference.

>
>     >
>     > ### Section 3.1.1 top-talkers
>     >
>     > I am a little puzzled how an attack coming out of *two* top-
>     > talkers (and thanks
>     > for using IPv6 examples :-) ) is a *distributed* DoS attack.
>     > Suggest to change
>     > the prefix to something broader (e.g., two /48) rather than a host
>     > /128 prefix.
[Yuhei]
We addressed the comment.
We now use 2001:db8:1::/48 and 2001:db8:2::/48 as example of
top-talker istead of 2001:db8::2/128 and 2001:db8::3/128.

>     >
>     > ### Section 3.1.1 figure 1 e.g.
>     >
>     > Is the use of "E.g.," in figures common ? or useful ? in figure 1
>     > ?
>     >
>     > As a side note, I am hard time to understand the figure 1: they
>     > are overloaded
>     > and little explanations on the graphics are given.
>     >
[Yuhei]
We deleted "E.g.," in all figures to increase readability.

>     > ### Section 3.1.5
>     >
>     > The intro text is about DNS torture attack, but the DOTS example
>     > is about DNS
>     > amplification attack, which appears as different attacks to me.
>     >
[Yuhei]
DNS torture attack is given as an example of attack which should be
inspected the Layer 7 information.
In this use case, DOTS signal does not convey the DNS tourture attack
information.

We modified the sentence as below because it's a little confusing.

OLD:
Some volumetric attacks, such as amplification attacks,

NEW:
Some volumetric attacks, such as DNS amplification attacks,

>     > ### Section 3.3.1
>     >
>     > To be honest, the value of this section about ML escapes me ;-)
>     > (notably why
>     > DOTS is helping here) but the example DOTS message would benefit
>     > of using
>     > 2001:db8::2/127 rather than the 2 /128 ;)
[Yuhei]
We aggregated 2001:db8::2/128 and 2001:db8::3/128 to 2001:db8::2/127 in Fig.17

>     >
>     > ### Section 6
>     >
>     > Like Murray, I also wonder why some reviews are labelled as IESG
>     > review ;-)
[Yuhei]
We addressed the comment.

>     >
>     > ## Notes
>     >
>     > This review is in the ["IETF Comments" Markdown format][ICMF], You
>     > can use the
>     > [`ietf-comments` tool][ICT] to automatically convert this review
>     > into
>     > individual GitHub issues.
>     >
>     > [ICMF]: https://github.com/mnot/ietf-comments/blob/main/format.md
>     > [ICT]: https://github.com/mnot/ietf-comments
>     >
>     >
>     >
>     > _______________________________________________
>     > Dots mailing list
>     > [e-mail]
>     > https://www.ietf.org/mailman/listinfo/dots
>
>     _________________________________________________________________________________________________________________________
>
>     Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
>     pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
>     a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
>     Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
>
>     This message and its attachments may contain confidential or privileged information that may be protected by law;
>     they should not be distributed, used or copied without authorisation.
>     If you have received this email in error, please notify the sender and delete this message and its attachments.
>     As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
>     Thank you.
>
>


-- 
----------------------------------
Yuuhei HAYASHI
08065300884
[e-mail]
[e-mail]
----------------------------------