Re: [Dots] AD review of draft-ietf-dots-data-channel-25

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] <[e-mail]>
> Sent: Friday, February 15, 2019 5:53 PM
> To: Konda, Tirumaleswar Reddy <[e-mail]>;
> Benjamin Kaduk <[e-mail]>
> Cc: [e-mail]; [e-mail]
> Subject: RE: AD review of draft-ietf-dots-data-channel-25
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is safe.
> 
> Hi Tiru,
> 
> Please see inline.
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:[e-mail]]
> > Envoyé : vendredi 15 février 2019 12:06 À : BOUCADAIR Mohamed TGI/OLN;
> > Benjamin Kaduk Cc : [e-mail];
> > [e-mail]
> > Objet : RE: AD review of draft-ietf-dots-data-channel-25
> >
> > I am catching up with the discussion, couple of points:
> >
> > 1)
> >       *  If a network resource (DOTS client) detects a potential DDoS
> >          attack from a set of IP addresses, the DOTS client informs its
> >          servicing DOTS gateway of all suspect IP addresses that need to
> >          be drop- or accept-listed for further investigation.
> >
> > Comment> I don't see why suspect IP addresses will be accept-listed ?
> >                     We may want to remove "or accept-listed" from the
> > above line.
> >
> 
> [Med] Ack.
> 
> > [Med] The dots client will know if its request is successfully delivered.
> > When an attack is ongoing, the dots client should not use it data
> > channel because it is likely to be perturbed.
> >
> > Comment> If the HTTP response from the server did not reach the client
> > because of a volumetric attack saturating the incoming the link, the
> > DOTS client will not know whether the configuration is successfully
> > updated or not. After the attack is mitigated, the client will have to
> > re-establish the TLS session and retrieve the configuration to check
> > if its last request was successfully applied or not before updating
> > the configuration.
> >
> 
> [Med] Agree. Still, how the client syncs its config with the one maintained by
> the server is implementation-specific. A client can send a GET before and/or
> after a configuration change request, in regular intervals, after attack
> mitigation, etc.

Adding a Implementation Note looks useful to me.

-Tiru

> 
> > Cheers,
> > -Tiru