Re: [Dots] (draft-ietf-dots-signal-filter-control) ACL Stats issue

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Mon, 29 April 2019 09:23 UTC

Return-Path: <TirumaleswarReddy_Konda@mcafee.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD4BC1200C3 for <dots@ietfa.amsl.com>; Mon, 29 Apr 2019 02:23:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Level:
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n_W6oX5OC_qA for <dots@ietfa.amsl.com>; Mon, 29 Apr 2019 02:23:22 -0700 (PDT)
Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20A22120115 for <dots@ietf.org>; Mon, 29 Apr 2019 02:23:22 -0700 (PDT)
X-NAI-Header: Modified by McAfee Email Gateway (5500)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1556529422; h=From: To:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-antispam-prvs:x-ms-oob-tlc-oobclassifiers: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-ms-exchange-senderadcheck:x-microsoft-antispam-message-info: Content-Type:Content-Transfer-Encoding:MIME-Version: X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=JEX8NeXfs38wQj83FV4XfCHAOSe/C+aFsNcixs ldFBA=; b=UmDV+e4TkUrpHy9GbL7z81v1VGyiF5uZSjwhxT0S Y3uVMxhFJdz00n06t33aqn6lfFWywVb8gjJpqJLecHnUlKCsHW 6ky/N8cZ4mc1KXJ9my/9/QbrVmiWK98XbTugYcqudVgicIW+IR 6WFf1jFwLAsyQ2D5ytTGfhOyKS4+NzA=
Received: from DNVEXAPP1N05.corpzone.internalzone.com (unknown [10.44.48.89]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 4ac7_886c_41d3f2f3_0f37_4617_b177_d30a8e996dd6; Mon, 29 Apr 2019 03:17:01 -0600
Received: from DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 29 Apr 2019 03:22:21 -0600
Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 29 Apr 2019 03:22:21 -0600
Received: from NAM02-BL2-obe.outbound.protection.outlook.com (10.44.176.241) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 29 Apr 2019 03:22:08 -0600
Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2567.namprd16.prod.outlook.com (20.177.226.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1835.12; Mon, 29 Apr 2019 09:22:06 +0000
Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::4873:7200:9e57:9e62]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::4873:7200:9e57:9e62%5]) with mapi id 15.20.1835.010; Mon, 29 Apr 2019 09:22:06 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: "mohamed.boucadair@orange.com" <mohamed.boucadair@orange.com>, Jon Shallow <supjps-ietf@jpshallow.com>, 'kaname nishizuka' <kaname@nttv6.jp>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: [Dots] (draft-ietf-dots-signal-filter-control) ACL Stats issue
Thread-Index: AdT6ZmI8uG0f606MQBW+/9uvcTWn6QA3ueOAAAD5v4AAAuISAAACLWCwAASh2bAAAFNQMAAALZggAB/gx7AADZnDQAAB9k5gAAGY4eAAh04/QAAA/5ngAAUJIHAAADrVQA==
Date: Mon, 29 Apr 2019 09:22:06 +0000
Message-ID: <BYAPR16MB2790D9396449CF75422C010CEA390@BYAPR16MB2790.namprd16.prod.outlook.com>
References: <787AE7BB302AE849A7480A190F8B93302EA649B4@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <c3c9614f-908a-c132-cd35-6c627e341f2b@nttv6.jp> <012601d4fb49$3328c000$997a4000$@jpshallow.com> <BYAPR16MB279020119E24ADCB54B339E3EA3D0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA6591A@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB27903D8D208FA3AC951FDEE4EA3D0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA65AD6@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB279013E8029BE0294293A333EA3D0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA6623D@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB2790146175B845622B2EF438EA3E0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA6649C@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB27909F467FFE57F380015E94EA3E0@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA66FEC@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> <BYAPR16MB279071FE429E252221521470EA390@BYAPR16MB2790.namprd16.prod.outlook.com> <787AE7BB302AE849A7480A190F8B93302EA67156@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
In-Reply-To: <787AE7BB302AE849A7480A190F8B93302EA67156@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.2.0.6
dlp-reaction: no-action
authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com;
x-originating-ip: [103.245.47.20]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 192a4425-9860-4f08-b67e-08d6cc842621
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600141)(711020)(4605104)(2017052603328)(7193020); SRVR:BYAPR16MB2567;
x-ms-traffictypediagnostic: BYAPR16MB2567:
x-microsoft-antispam-prvs: <BYAPR16MB2567E3AF2C5F6F211ED7AA27EA390@BYAPR16MB2567.namprd16.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8273;
x-forefront-prvs: 0022134A87
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(136003)(376002)(346002)(39850400004)(189003)(199004)(32952001)(13464003)(486006)(446003)(11346002)(68736007)(2906002)(26005)(476003)(53546011)(6506007)(86362001)(102836004)(66066001)(71190400001)(186003)(99286004)(71200400001)(8936002)(81166006)(6116002)(3846002)(66446008)(64756008)(66556008)(66476007)(66946007)(305945005)(97736004)(93886005)(73956011)(76116006)(53936002)(81156014)(74316002)(2501003)(8676002)(7736002)(9686003)(6246003)(72206003)(25786009)(110136005)(55016002)(478600001)(6436002)(33656002)(80792005)(7696005)(229853002)(316002)(14444005)(52536014)(5024004)(5660300002)(256004)(14454004)(76176011)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2567; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: 2YKSQgZwgI4mMwZp162q3FyUJIhnTHNis5I5wa+0Kmz2vFVetOvD8l1ji2X3OUw7qUtf8NolZ1kb/YKywm/FSYTTSPlFGcZlza7d9eFdoMS0nW+BpSO0/+t6o+Ns/Hg2hiwQQ5V9joy/glnTX/PE1LBbLESJoz6iyZWjCpiukHPLMH/4hBAjrn7VkE5f1qW+IJXMn1HyEkUoq7NbBwxvIHlWbagV3t8bC4YteVxvLAjekSIaWNybZ4Vu2XLukunkUiMS8X+DWtQ9HvppRFd8dvBBpNl39gMVVjBURixzcVSI7vxqEVrB6ExFxenMRmnTXoH8H3lL5DQ/ki48jyEE7Esjyh4Now8c8VctGJ7FI5rXlDWqQX/T/NXsXiW9Qv8923V2cP7baGPBn5LOJbvgMHDHA33Ow/oHnSZfU1CKEmk=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 192a4425-9860-4f08-b67e-08d6cc842621
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Apr 2019 09:22:06.5976 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2567
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Level:
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0.1
X-NAI-Spam-Version: 2.3.0.9418 : core <6534> : inlines <7062> : streams <1820054> : uri <2838418>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/g9ICqaDcXepWwVhCJkw41OUWGkA>
Subject: Re: [Dots] (draft-ietf-dots-signal-filter-control) ACL Stats issue
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Apr 2019 09:23:24 -0000

> -----Original Message-----
> From: mohamed.boucadair@orange.com <mohamed.boucadair@orange.com>
> Sent: Monday, April 29, 2019 2:46 PM
> To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>om>;
> Jon Shallow <supjps-ietf@jpshallow.com>om>; 'kaname nishizuka'
> <kaname@nttv6.jp>jp>; dots@ietf.org
> Subject: RE: [Dots] (draft-ietf-dots-signal-filter-control) ACL Stats issue
> 
> This email originated from outside of the organization. Do not click links or open
> attachments unless you recognize the sender and know the content is safe.
> 
> (Focusing on this particular point).
> 
> 
> > -----Message d'origine-----
> > De : Konda, Tirumaleswar Reddy
> > [mailto:TirumaleswarReddy_Konda@McAfee.com]
> > Envoyé : lundi 29 avril 2019 10:52
> > À : BOUCADAIR Mohamed TGI/OLN; Jon Shallow; 'kaname nishizuka';
> > dots@ietf.org Objet : RE: [Dots]
> > (draft-ietf-dots-signal-filter-control) ACL Stats issue
> >
> > > > >
> > > > >  ACL-specific stats and mitigation stats will give a clear
> > > > > > picture of the traffic rate-limited, bad traffic dropped by
> > > > > > the DDoS mitigation system, and using these stats the DOTS
> > > > > > client can heuristically determine the amount of legitimate
> > > > > > traffic dropped because of rate-limit and the impact of the attack on its
> service.
> > > > >
> > > > > [Med] The impact can be observed locally (e.g., bad QoS,
> > > > > inability to
> > > > access a
> > > > > service, instable connectivity, etc.). I still don’t see how
> > > > > sharing the
> > > > ACL stats
> > > > > will be helpful here.
> > > > >
> > > > > A DOTS client can preinstall the same rate-limit filter with but
> > > > > with
> > > > different
> > > > > policies. It can select the appropriate ACL to
> > > > > activate/deactivate based on local experience.
> > > >
> > > > I don't get how the local experience will help the client pick an
> > > > alternate mitigation provider who can handle the attack scale.
> > >
> > > [Med] Modern CPEs include automated features to assess the
> > > availability of services such as VoIP, IPTV, etc. The DOTS client
> > > can be fed with input
> > from
> > > these modules and react accordingly.
> 
> [Med] s/client/server.
> 
> >
> > I meant the target network cannot infer the amount of legitimate
> > traffic (or infer the number of users) unable to use its service
> > because of the rate- limit action.
> >
> 
> [Med] The amount of traffic is not required to assess the availability of
> "nominal" services (the example above). What is really important is whether
> some critical services are available. That information can be determined without
> needing the ACL stats.

I am not referring to "nominal" services or critical resources. For instance, consider Netflix is not accessible to a large number 
of users because of the rate-limit action.

-Tiru