Re: [Dots] Workflow question about draft-h-dots-mitigation-offload-expansion-00

[Töma Gavrichenkov <[e-mail]>]

Hello all,

On Sat, Nov 3, 2018 at 6:15 AM Roman Danyliw <[e-mail]> wrote:
> [..]
> (1) [telemetry system]->[orchestrator]: DOTS Mitigation Request
> (2) [network admin]->[orchestrator]: DOTS Mitigation Request
> (3) [orchestrator]->[routers/switch]: BGP redirect mitigation
> (4) [DMS]->[orchestrator]: DOTS Mitigation Request
> (5) [orchestrator]->[routers/switch]: BGP redirect mitigation
>
> ** If the orchestrator tasked the routers/switches per (3) to handle
> the attack traffic, how did the DMS get involved in the mitigation?
> What's the difference between the attack traffic handled by (3)
> and the DMS?  How is that coordination happening?

1) I'm not the author of the draft, but as far as I understand it the
use case is as follows (and you might want to take that with a grain
of salt):

Actually, the orchestrator doesn't ask for handling the *attack*
traffic during the step 3. At this point, routers still have no clue
about what's the attack traffic is (they only know who's the target,
as reported by the telemetry system), so they just start routing *all*
of the inbound traffic (including legitimate one) coming towards the
target IP address or IP prefix, via the DMS.

2) Going through the same paragraph, I'm a little bit concerned about
the "top-talker" part. Under most conditions and assuming most common
mitigation boxes, it's either useless or even dangerous to do that
during a volume-based DDoS attack. I'd suggest to put, e.g., an
amplification example here, with port blocking done instead of IP
address blocking.

| Töma Gavrichenkov
| gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191
| mailto: [e-mail]
| fb: ximaera
| telegram: xima_era
| skype: xima_era
| tel. no: [phone]