Re: [Dots] Target-Attack-type expansion: more discussion

Hi, Töma
please see inline;

>On Mon, May 6, 2019 at 1:10 PM MeiLing Chen <chenmeiling@chinamobile.com> wrote:
>> Actually, It is more inclined to use TCP/IP four-layer protocol.

>Which layer is QUIC then?

>The Internet protocol suite is not really layered.  OSI model is, but
>the IETF as a whole tends to slip away from the layered model.  To
>quote Christian Huitema:

>"There is also beauty in *not* having a layered architecture [..]. It
>is great to see transport functions like acknowledgement or flow
>control fully contained in the Quic transport. Quic is about transport
>innovation, and that pretty much requires direct access to the network
>API. In practice, layered implementation hide that API, so the
>transport developers have to constantly negotiate with the
>intermediate layer developers."

>I would strongly oppose a classification based on "exploited protocol
>layers".  As attractive as it is academically, it makes operational
>issues more opaque.

[MeiLing]What we pay more attention to here is the method of attack;"protocol layer" is a field that we design for classification and definition; Because for different layers of protocol, the required parsing power and times are not the same.
For example, the DNS protocol can be resolved to the UDP layer or to the application (DNS) layer. The same problem applies to TCP and HTTP; In order to better analyze attacks and defend against attacks, we think it is more explicit and helpful with the indication of  the layer and type of protocol.

_______________________________________________
Dots mailing list
Dots@ietf.org
https://www.ietf.org/mailman/listinfo/dots