Re: [Dots] DOTS Telemetry: Interop Clarification #3

[[e-mail]]

Re-,

I do agree that having a latest-update leaf in the mapping table is useful (easily detect mismatches). This is something we can add to the data channel extension.

I'm not sure it is useful to send that new attribute in the signal channel as the attack details won' be useful in the lack of the attack description.

I do think that the current wording in the draft is appropriate: (1) agents should ensure they are in sync as much as possible, (2) avoid including the attack details in the signal channel with one exception when an agent detects a synch issue.

==
   When conveying attack details in DOTS telemetry messages (Sections
   7.2, 7.3, and 8), DOTS agents MUST NOT include 'attack-name'
   attribute except if the corresponding attack mapping details were not
   shared with the peer DOTS agent.
==

If there is a message size issue, a dots agent can send the telemetry in separate messages, use the new bloc options, etc.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
Envoyé : vendredi 26 juin 2020 09:27
À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka
Cc : [e-mail]
Objet : RE: DOTS Telemetry: Interop Clarification #3

Hi Med,

I prefer avoiding the need to send attack description in the DOTS signal channel. One way is to send the attack-id and last-update timestamp so the peer knows whether it has received the latest snapshot or not.

Cheers,
-Tiru

From: [e-mail] <[e-mail]>
Sent: Friday, June 26, 2020 12:51 PM
To: Konda, Tirumaleswar Reddy <[e-mail]>; kaname nishizuka <[e-mail]>
Cc: [e-mail]
Subject: RE: DOTS Telemetry: Interop Clarification #3


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


________________________________
Re-,

Please see inline.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
Envoyé : vendredi 26 juin 2020 08:36
À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka
Cc : [e-mail]<mailto:[e-mail]>
Objet : RE: DOTS Telemetry: Interop Clarification #3

I meant attack mapping details can be sent in the DOTS data channel and no need to use DOTS signal channel.
[Med] Sure. We are not changing this behavior.

The capabilities of a DOTS mitigator cannot be updated dynamically during mitigation that would warrant the need to send the attack-description in the DOTS signal channel during attack mitigation.
[Med] The issue is when the mapping details were updated but the client didn't retrieved the up-to-date list. If an attack occurs, sending the attack-id only won't be useful for the client; hence the need to send also the attack-name if attack-details are included in the telemetry data.

Identifying a new attack requires update to the DOTS mitigator, human-intervention is required to create the attack description and attack-id.
[Med] We are not making assumptions why the mapping details are not in-sync between the client and server.

In short, no need overload DOTS signal channel to send the attack description.
[Med] As you know, the reco we have is to avoid sending attack-name in the signal channel. There are exceptions where the attack-name may be included, though.

-Tiru

From: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Sent: Friday, June 26, 2020 11:34 AM
To: Konda, Tirumaleswar Reddy <[e-mail]<mailto:[e-mail]>>; kaname nishizuka <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: RE: DOTS Telemetry: Interop Clarification #3


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


________________________________
Hi Tiru,

Not sure to get your comment. Can you please clarify?

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
Envoyé : vendredi 26 juin 2020 07:15
À : BOUCADAIR Mohamed TGI/OLN; kaname nishizuka
Cc : [e-mail]<mailto:[e-mail]>
Objet : RE: DOTS Telemetry: Interop Clarification #3

Hi Med,

I don't think the capabilities of the mitigator will get updated dynamically during an active attack to send the new attack details (attack-name) in the DOTS signal channel protocol.

Cheers,
-Tiru

From: Dots <[e-mail]<mailto:[e-mail]>> On Behalf Of [e-mail]<mailto:[e-mail]>
Sent: Friday, June 26, 2020 1:02 AM
To: kaname nishizuka <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [Dots] DOTS Telemetry: Interop Clarification #3


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


________________________________
Re-,

You reported the following in the interim :
==
3."DOTS agents MUST NOT include 'attack-name' attribute except if the corresponding attack mapping details were not shared with the peer DOTS agent". But how can the DOTS server know they're shared or not?
===

This is implementation-specific. The DOTS server may record which version of the mapping table it shared with a DOTS client.

Do you think that we need to include such details in the spec? or do you have mind something else?

Thanks.

Cheers,
Med



_________________________________________________________________________________________________________________________



Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc

pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler

a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,

Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.



This message and its attachments may contain confidential or privileged information that may be protected by law;

they should not be distributed, used or copied without authorisation.

If you have received this email in error, please notify the sender and delete this message and its attachments.

As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.

Thank you.

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.