[Dots] draft-francois-dots-ipv6-signal-option-00

[Jérôme François <[e-mail]>]

Dear all,

We'd like to present our response to the community feedback we received
after presenting our draft-francois-dots-ipv6-signal-option-00 draft in
Berlin.


1) On the use of the IPv6 Hop-by-Hop options:

We recognized that this can be an issue as it may entail some processing
overhead at the router side (also described in draft-krishnan-ipv6-hopbyhop-05).

The main issue is the unbounded number of TLV encoded attributes in the
option. In our opinion, our proposition is not particularly affected by
this threats, due the following:

   * only DOTS clients may craft such an option. Therefore, with a
previously defined policy set, other hosts trying to use it should be
easily detected and drop at the first router they will encounter.

   * we assume that there is a trust relationships between dots agents
and the network (remaining that we mainly focus on the intra-domain use
case). If not, additional techniques (rate / size limiting) can be
applied on the IPv6 packets.

   * there is some processing overhead  but (i)  not all routers need to
process them (a sort of trade-off between reaching the
server and the overhead) and (ii) this overhead would be insignificant
regarding the DDoS impact, which in our mind make this more acceptable.


2) The option encodes the same information that the client sends to the
server but the main difference is that the propagation will be done in
an epidemic manner (i.e. not taking the regular forwarding path, which
might even been under attack).

One one hand, you can restrict the  epidemic propagation towards a
certain direction to be sure that the signaling is not going to a
direction too far from the sever. On the other hand, we recommend in our
draft to use all possible paths in the very first instants of the attack
to have more chance to reach the client or a DOTS gateway. In brief, our
proposal is intended to be used in intra-domain scenario with
distributed gateways
rather than only relying only a single DOTS server.

We will take those into account in our draft as well as any additional
feedback we'll reveive on the ML.

We'll also introduce our draft on the ipv6 ML for advice and feedback.
We have also started first experiments with running code.

Best regards,
Jérôme