Re: [Dots] Filter on source (RE: DOTS telemetry Issues picked up in Interop Testing

[[e-mail]]

Hi Jon,

Here is a text proposal with a warning about the use of these filters:

   DOTS clients may also filter out the asynchronous notifications from
   the DOTS server by indicating a specific source information.  To that
   aim, a DOTS client may include source-prefix, source-port, or source-
   icmp-type in an Uri-Query option.  The same considerations (ranges,
   multiple values) specified for target clauses apply for source
   clauses.  Special care SHOULD be taken when using these filters as
   some attacks may be hidden to the requesting DOTS client (e.g., the
   attack changes its source information).

Do we need to say more?

Cheers,
Med

De : Dots [mailto:[e-mail]] De la part de [e-mail]
Envoyé : mardi 21 avril 2020 13:36
À : Jon Shallow; [e-mail]
Objet : [Dots] Filter on source (RE: DOTS telemetry Issues picked up in Interop Testing

Re-,

Why filtering on the source if all the attack traffic is coming from the same port number?

I'm nervous about setting a filter that may hide useful attack telemetry (not matching that filter).

Cheers,
Med


De : Jon Shallow [mailto:[e-mail]]
Envoyé : mardi 21 avril 2020 12:56
À : BOUCADAIR Mohamed TGI/OLN; [e-mail]
Objet : RE: [Dots] DOTS telemetry Issues picked up in Interop Testing


  Do we need to be able to filter on source attributes as well?
[Med] What would be the usage? Is it the case of an administrator that is aware (using some means) that some sources are involved an attacks on other networks, then sends a request to its server to filter telemetry data bound to these source? Filtering in this case may be problematic as some attacks may be observed but are hidden by the filter on the source. Or do we want to focus on very few talkers? For example, the client would instruct the server to send data only related to the top-talker, 3 first top-talkers, etc.?

Jon> Source-port= could be useful - especially when being subjected to a reflected type attach where all the traffic is coming from, say, source port 53

Jon> Otherwise, it may help to filter on top-talkers, vendor specific attack types etc.

Jon> Which then leads me on to something else.  If we asking for telemetry for 2 (or more) different target IPs and the server is returning vendor specific attack details.  For attack-detail, keyed by attack-id, if the same attack is hitting more than 1 target IP, can I display this information per IP or does it have to be aggregated?