Re: [Dots] Feedback on draft-nishizuka-dots-inter-domain-mechanism-01

["Roman D. Danyliw" <[e-mail]>]

Hi Frank!

Thanks for the response.  My comments are inline.  Where I removed a item, you answered my question (thanks).

> -----Original Message-----
> From: Dots [mailto:[e-mail]] On Behalf Of Xialiang (Frank)
> Sent: Wednesday, July 20, 2016 3:34 AM
> To: Roman D. Danyliw <[e-mail]>
> Cc: [e-mail]
> Subject: Re: [Dots] Feedback on draft-nishizuka-dots-inter-domain-
> mechanism-01
> 
> Hi Roman,
> Thanks for the detailed comments.
> My response is inline:
> 
> B.R.
> Frank
> 
> -----邮件原件-----
> 发件人: Dots [mailto:[e-mail]] 代表 Roman D. Danyliw
> 发送时间: 2016年7月18日 21:03
> 收件人: [e-mail]
> 主题: [Dots] Feedback on draft-nishizuka-dots-inter-domain-mechanism-01
> 
> Hello WG!
> 
> WG chair hat off ...
> 
> In reading through draft-nishizuka-dots-inter-domain-mechanism-01 I have
> the following feedback:

[snip]

> (4) Section 5, Provisioning stage, "A DOTS client should register itself to the
> DOTS server, as well as enable capacity building in advance." In the context
> of DOTS, what protocol support is expected to "enable capacity building in
> advance"?
> [Frank]: In section 5.1.2, we have the details: "The customers (DOTS client)
> registers to the operator controller with the configuration and capability
> building including protection methods, process capacity, protected zone,
> security profile, white/black-list, etc". Does it make sense?

It does but then I have a nit related to the use of the phrase "capacity building".  It doesn't seem to fit here for me.

> (5) Section 5.1.1, customer_name, How should this name be generated?
> [Frank]: it's generated by DOTS client itself, but the custom_id is the unique
> value generated by the DOTS server

If it's a free form value, I'd recommend stating that for clarify in the draft.
 
> (6) Section 5.1.1, ip_version, To what traffic does this version number refer?
> [Frank]: the version of the DOTS client's all traffic

I still need a little help understanding.  This field tells the DOTS server that the DOTS client traffic will be IPv6 or v4?  If so, which traffic?  What happens if there is v4 and v6 traffic?  The one noted in the protected_zone, on the white/blacklist?  What happens if ip_version = "v4" and a ipv6_address is set in protected_zone.

[snip]

> (9) Section 5.1.1, protected_ports, To clarify, is this the subset of ports
> possible to enumerate in future mitigation requests?
> [Frank]: Yes, I think so. I tend to think there should be some restriction here,
> which means dots server only protect those ports that have been registered.

I'd recommend explicitly documenting this relationship between protected_ports and future mitigation requests.

> (10) Section 5.1.1, whitelist and blacklist, I would recommend being explicit
> on what the DOTS server is supposed to do with this list.
> [Frank]: In registration response message, it can indicate whether DOTS
> server can support it. Do you mean more information than this?

Based on the definition in the text of whitelist, it appeared that the client could send a characterization of particular traffic.  I was recommending that the text be explicit is saying something like (not precise language) -- "The DOTS server should ensure that traffic described in the 'whitelist' field set during registration time is not impacted in future mitigation requests by the DOTS client."  Some equivalent for blacklist. 

> (12) When is the Heartbeat message sent
> [Frank]: It's periodically sent to the peer DOTS agents right after the DOTS
> registration process is finished, and till the DOTS client cancels its registration
> to the DOTS server.

Understood.  I didn't see that in the text.  How often is periodically?

> (14) Section 5.2.1, DST_IP is used in the definition of multiple fields but is not
> defined.  Is this field the same as dst_ip from packet_header?
> [Frank]: it should be the same.

I recommend using a consistent case.

> (17) Section 5.2.1, current_throughputs, What does it mean to have multiple
> CSV separated values in this field?
> [Frank]: good question. The reason we use multiple CSV is to send a set of
> attack information in one DOTS mitigation request message, for increasing
> the efficiency.

Would there be timestamps with these rates?  Assuming this was a legal syntax, "3.5, 58.3, 48.3", how would that be interpreted?

[snip]

> (20) Section 5.2.1, hash, Is this hash calculated on the complete payload or
> the truncated value per the offset field?
> [Frank]: the truncated part.

I recommend explicitly stating the target of the hash as you clarified here.

Roman