Re: [Dots] draft-ietf-dots-telemetry: URI-Query

Jon Shallow <supjps-ietf@jpshallow.com> Sun, 05 April 2020 14:33 UTC

Return-Path: <supjps-ietf@jpshallow.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0F683A0ACC for <dots@ietfa.amsl.com>; Sun, 5 Apr 2020 07:33:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ccqfNdr20Nq for <dots@ietfa.amsl.com>; Sun, 5 Apr 2020 07:33:03 -0700 (PDT)
Received: from mail.jpshallow.com (mail.jpshallow.com [217.40.240.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B91E33A0ACB for <dots@ietf.org>; Sun, 5 Apr 2020 07:33:02 -0700 (PDT)
Received: from mail2.jpshallow.com ([192.168.0.3] helo=N01332) by mail.jpshallow.com with esmtp (Exim 4.92.3) (envelope-from <jon.shallow@jpshallow.com>) id 1jL6KW-0004Ep-VN; Sun, 05 Apr 2020 15:32:57 +0100
From: Jon Shallow <supjps-ietf@jpshallow.com>
To: mohamed.boucadair@orange.com, dots@ietf.org
References: <787AE7BB302AE849A7480A190F8B93303148E648@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
In-Reply-To: <787AE7BB302AE849A7480A190F8B93303148E648@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
Date: Sun, 05 Apr 2020 15:32:55 +0100
Message-ID: <148e01d60b57$18a0f3f0$49e2dbd0$@jpshallow.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQIwK25rW36R5rWx96QHgnlpzaSOc6e2UTAA
Content-Language: en-gb
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/Ymbj2tUh-8HJl7U-o_yYKDTbY7A>
Subject: Re: [Dots] draft-ietf-dots-telemetry: URI-Query
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 05 Apr 2020 14:33:05 -0000

Hi Med,

I initially thought of using Queries for the /mitigate case - as a DOTS client my IP is getting hammered so I put in a PUT /mitigate with just a target-prefix for my IP.  Then I can focus in on detail by doing a GET /mitigation with Queries to filter down the potential abundance of data flowing back with the telemetry extensions.  Likewise, if I did a PUT /mitigate with both target-prefix and target-port but am also interested with what is happening on other ports I could do a GET /mitigate with Queries which supersede what the PUT /mitigate specified.

Yes, this can all be done with a PUT /tm and a vanilla GET /tm - but then I would need to be sending both a PUT and GET - increasing traffic - if I wanted to look at different scenarios and then add in a DELETE to the mix to keep down the number of tmids.  A big burst of analysis could consume many tmids, and then we need to consider what happens when there is a wraparound of the tmid counter.  Here, a simple PUT to initiate telemetry recording followed by GETs with different Queries may give flexibility needed.

>From the DOTS server perspective, at the CoAP level, each different tmid for a cuid is a different resource which is potentially observable (and so needs to be unique).  Rapidly changing resources adds in unnecessary overhead.

Regards

Jon

> -----Original Message-----
> From: Dots [mailto: dots-bounces@ietf.org] On Behalf Of mohamed.boucadair@orange.com
> Sent: 05 April 2020 08:58
> To: Jon Shallow; dots@ietf.org
> Subject: [Dots] draft-ietf-dots-telemetry: URI-Query
> 
> Hi Jon,
> 
> For /tm, a client that is interested to receive notifications for a particular target
> (@, port, protocol, etc.) can maintain only a tmid with that target using a PUT
> request. What is the benefit if the dots client sends a PUT /tm for an IP prefix,
> but then sends a GET to target the notifications bound to a specific protocol?
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : Jon Shallow [mailto:supjps-ietf@jpshallow.com]
> > Envoyé : vendredi 3 avril 2020 16:17
> > À : BOUCADAIR Mohamed TGI/OLN; dots@ietf.org
> > Objet : RE: [Dots] /mitigate RE: New Version Notification for draft-
> > ietf-dots-telemetry-05.txt
> >
> >
> > Jon> What about the use of Uri-Queries to filter on what is returned
> > for a GET?
> > >
> 
> _______________________________________________
> Dots mailing list
> Dots@ietf.org
> https://www.ietf.org/mailman/listinfo/dots