Re: [Dots] New Version Notification for draft-fu-dots-ipfix-extension-00.txt

["Roland Dobbins" <[e-mail]>]

On 24 Oct 2015, at 2:15, Roman D. Danyliw wrote:

> If there are any questions or concerns, please let us know and we will 
> be happy to help.

The intent of the language in the charter discussing existing telemetry 
standards was to ensure that the DOTS WG had the option of utilizing 
and/or exploring the extension of said standards within the realm of 
using them for threat signaling and request handling purposes; this was 
the spirit in which it was contributed:

<http://www.ietf.org/mail-archive/web/dots/current/msg00131.html>

The concern is that by getting into details of telemetry format 
definition which are unrelated to threat signaling, we are inadvertently 
embracing the much larger task of general telemetry format redefinition, 
which has implications far beyond the threat signaling arena and is a 
much larger, more involved, and more complex task than defining a threat 
signaling standard.

draft-fu-dots-ipfix-extension-00 is not related to threat signaling.  It 
is related to the underlying generation and export of network traffic 
statistics and characteristics.  From draft-fu-dots-ipfix-extension-00:

    This document presents the IPFIX IEs which are available for the
    network attacks detection, some of them are the new defined IPFIX
    IEs and their formats are specified. The wise utilization of these
    IEs will improve the network security and will support the offline
    analysis of data from different operators in the future with minimal
    resource consumption.

There is nothing in draft-fu-dots-ipfix-extension-00 which relates to 
threat signaling.  Nowhere in draft-fu-dots-ipfix-extension-00 is the 
topic of threat signaling mentioned, even in passing.

I apparently missed an email message from the chairs to the list on this 
topic on 5Oct2015; apologies for this oversight.  The concerns expressed 
above are not based upon any company perspective, as was implied in that 
message, but are the concerns of an individual contributor to the WG 
that we are at risk of inadvertently taking on tasks which are outside 
the realm of threat signaling, thereby making it more difficult to 
accomplish our primary goal of developing a standardized mechanism for 
DDoS threat signaling.

These concerns relate to the risk of inadvertent WG scope-creep, nothing 
more.

 From the DOTS charter:

-----

Any modification of or extension to existing protocols must be in close 
coordination with the working
groups responsible for the protocol being modified, and may be done in 
this working group after agreement with all the relevant WGs and 
responsible Area Directors.

-----

Has this coordination with regards to draft-fu-dots-ipfix-extension-00 
taken place, and has the agreement of the Operations and Management Area 
AD and the IPFIX chairs to this proposed modification to IPFIX been 
secured?

Many thanks!

-----------------------------------
Roland Dobbins <[e-mail]>