[Dots] DOTS Telemetry: URI Path

<mohamed.boucadair@orange.com> Thu, 23 January 2020 15:41 UTC

Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27A5312013B for <dots@ietfa.amsl.com>; Thu, 23 Jan 2020 07:41:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.598
X-Spam-Level:
X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4MEilLbvMuot for <dots@ietfa.amsl.com>; Thu, 23 Jan 2020 07:41:25 -0800 (PST)
Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0616D12007C for <dots@ietf.org>; Thu, 23 Jan 2020 07:41:25 -0800 (PST)
Received: from opfedar02.francetelecom.fr (unknown [xx.xx.xx.4]) by opfedar27.francetelecom.fr (ESMTP service) with ESMTP id 483RMR6K29z2y3d; Thu, 23 Jan 2020 16:41:23 +0100 (CET)
Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.76]) by opfedar02.francetelecom.fr (ESMTP service) with ESMTP id 483RMR5FkFzCqkw; Thu, 23 Jan 2020 16:41:23 +0100 (CET)
Received: from OPEXCAUBMA2.corporate.adroot.infra.ftgroup ([fe80::e878:bd0:c89e:5b42]) by OPEXCAUBM7E.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0468.000; Thu, 23 Jan 2020 16:41:23 +0100
From: mohamed.boucadair@orange.com
To: "dots@ietf.org" <dots@ietf.org>, 'kaname nishizuka' <kaname@nttv6.jp>
Thread-Topic: DOTS Telemetry: URI Path
Thread-Index: AdXSA4rBzLMvgmnTQFWFKSY1yB+Z8Q==
Date: Thu, 23 Jan 2020 15:41:22 +0000
Message-ID: <787AE7BB302AE849A7480A190F8B93303140D0DC@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.114.13.247]
Content-Type: multipart/alternative; boundary="_000_787AE7BB302AE849A7480A190F8B93303140D0DCOPEXCAUBMA2corp_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/GUJEVQRO2ccHQqT3P8r22YSqg3U>
Subject: [Dots] DOTS Telemetry: URI Path
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Jan 2020 15:41:27 -0000

Hi all,

In the current version of the telemetry draft, we are using '/telemetry' for telemetry-related operations. Kaname suggested to define three operation suffixes for that. I do think that two are sufficient as indicated below:

         +-------------------------+----------------+
         | Operation               | Operation Path |
         +-------------------------+----------------+
         | Telemetry Setup         | /tm-setup      |
         +-------------------------+----------------+
         | Telemetry               | /tm            |
         +-------------------------+----------------+

A dedicated uri (/tm-setup) will be used for telemetry setup operations (baseline, configuration): see the excerpt below:

  augment /ietf-signal:dots-signal/ietf-signal:message-type:
    +--:(telemetry-setup) {dots-telemetry}?
    |  +--rw telemetry* [cuid tsid]
    |     +--rw cuid                string
    |     +--rw cdid?               string
    |     +--rw tsid                uint32
    |     +--rw telemetry-config
    |     |  +--rw low-percentile?    percentile
    |     |  +--rw mid-percentile?    percentile
    |     |  +--rw high-percentile?   percentile
    |     |  +--rw unit-config* [unit]
    |     |     +--rw unit           unit
    |     |     +--rw unit-status?   Boolean
            ...
    |     +--rw baseline
    |        +--rw total-pipe-capability* [unit]
    |        |  +--rw unit    unit
    |        |  +--rw pipe?   uint64
    |        +--rw total-traffic-normal-baseline* [unit protocol]
    |        |  +--rw unit                 unit
    |        |  +--rw protocol             uint8
    |        |  +--rw low-percentile-g?    yang:gauge64
    |        |  +--rw mid-percentile-g?    yang:gauge64
    |        |  +--rw high-percentile-g?   yang:gauge64
    |        |  +--rw peak-g?              yang:gauge64
    |        +--rw total-connection-capacity* [protocol]
    |           +--rw protocol                     uint8
      ...

While '/tm' can be used for sharing pre-mitigation telemetry data (an excerpt of the tree is shown below).

    +--:(telemetry) {dots-telemetry}?
       +--rw pre-mitigation* [cuid telemetry-id]
          +--rw cuid                       string
          +--rw cdid?                      string
          +--rw telemetry-id               uint32
          +--rw target
          |  +--rw target-prefix*       inet:ip-prefix
          |  +--rw target-port-range* [lower-port]
          |  |  +--rw lower-port    inet:port-number
          |  |  +--rw upper-port?   inet:port-number
          |  +--rw target-protocol*     uint8
          |  +--rw target-fqdn*         inet:domain-name
          |  +--rw target-uri*          inet:uri
          +--ro total-attack-traffic* [unit protocol]
          |  +--ro unit                 unit
          |  +--ro protocol             uint8
          |  +--ro low-percentile-g?    yang:gauge64
          |  +--ro mid-percentile-g?    yang:gauge64
          |  +--ro high-percentile-g?   yang:gauge64
          |  +--ro peak-g?              yang:gauge64
          +--ro total-traffic* [unit protocol]
          ...
          +--ro attack-detail
             +--ro vendor-id?         uint32
             +--ro attack-id?         string
             +--ro attack-name?       string
             +--ro attack-severity?   attack-severity
             +--ro start-time?        uint64
             +--ro end-time?          uint64
             +--ro source-count
             |  +--ro low-percentile-g?    yang:gauge64
             |  +--ro mid-percentile-g?    yang:gauge64
             |  +--ro high-percentile-g?   yang:gauge64
             |  +--ro peak-g?              yang:gauge64
             +--ro top-talker
                +--ro source-prefix* [source-prefix]
                   +--ro spoofed-status?            boolean
                   +--ro source-prefix              inet:ip-prefix
                ...

Unless there are objections, we will implement this change in the next iteration of the draft.

Cheers,
Med