Re: [Dots] Fwd: New Version Notification for draft-fu-dots-ipfix-extension-01.txt

[kaname nishizuka <[e-mail]>]

Hi Frank,

I think the content of the draft has changed dramatically in this revision.
Though I'm not sure that the DOTS WG is the most suitable place to handle the extention of IEs of IPFIX,
I added a comment in reply especially from operational view point.

best regards,
kaname nishizuka

On 2016/06/14 18:40, Xialiang (Frank) wrote:
> Hi all,
> We submit a new version of this draft.
> Thanks for the discussion and comments from this WG, we try to clarify the puzzles and explain the real problem we want to solve and the solution in this updated document.
>
> Overall, we want to cover the following points in this version:
>
> 1. This document mainly concerns on the attack telemetry information, such as: the new telemetry information we need for attack detection, and how to use them, etc;
>
> 2. Current IPFIX and PSAMP standards do not support the detection of some connection-based and Zero-Day DDoS attacks well, which normally are the kinds of the low & slow DDoS attack and not easy to be inspected as flood attacks. In our draft, we analyze this point and clearly propose to use the connection sampling method  (which is specified by IPFIX/PSAMP)  with some extended new IPFIX IEs to fill the gap;
[clarifying question]
Is the connection sampling method equal to the filtering technique in RFC5475?

> 3. We also try to explain that the connection sampling method and the new specified IPFIX IEs are very effective for detection some categories of attack, and are feasible in the aspects of implementation, performance, deployment;
The main concern regarding to this proposal is performance impact on the sampling process.
How can it select the connection which includes attack vector like slow dos.
Description of some technique of selecting malicious connections out of huge number of connections would be needed.

> 4. There are already some good solutions applied in today's network for DDoS attack detection and runs well, but some of they are proprietary and not standardized, some of them are still not suitable for some kinds of attack well. Our proposal will not conflict to them and more intend to be the router/switch's functional enhancement, or just another solution choice.
Many operators are using coarse-to-fine approach.
They are using flow sampling for coarse detection and non-sampling methods like DPI for fine-grained detection.
Non-sampling methods could be more suitable than the new specified IPFIX IEs to detect some categories of attacks.
Could you describe the technique of connection sampling in detail which will not affect the performance of router/switches.

> Any comments from you are warmly welcome!
>
> B.R.
> Frank
>
>
>
> -----邮件原件-----
> 发件人: [e-mail] [mailto:[e-mail]]
> 发送时间: 2016年6月14日 11:35
> 收件人: limin 00223961; DaCheng Zhang; Futianfu; Dacheng Zhang; Xialiang (Frank)
> 主题: New Version Notification for draft-fu-dots-ipfix-extension-01.txt
>
>
> A new version of I-D, draft-fu-dots-ipfix-extension-01.txt
> has been successfully submitted by Liang Xia and posted to the IETF repository.
>
> Name:		draft-fu-dots-ipfix-extension
> Revision:	01
> Title:		IPFIX IE Extensions for DDoS Attack Detection
> Document date:	2016-06-14
> Group:		Individual Submission
> Pages:		21
> URL:            https://www.ietf.org/internet-drafts/draft-fu-dots-ipfix-extension-01.txt
> Status:         https://datatracker.ietf.org/doc/draft-fu-dots-ipfix-extension/
> Htmlized:       https://tools.ietf.org/html/draft-fu-dots-ipfix-extension-01
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-fu-dots-ipfix-extension-01
>
> Abstract:
>     DDoS Open Threat Signaling (DOTS) Working Group is for developing
>     the standard signaling mechanisms, together with the DDoS related
>     telemetry and threat handling requests and data transmitted by them
>     used in DDoS problem space. Although IP Flow Information Export
>     (IPFIX), Packet Sampling (PSAMP), and Packet Selection methods are
>     useful for network security inspection, there are still some gaps
>     existing to identify some categories of DDoS attacks.  To fill in
>     the gaps, this document describes the connection sampling mechanism
>     and explains why it is needed for detecting DDoS attacks. It also
>     defines several new IPFIX Information Elements (IEs). Then, it
>     presents some examples to show how to use these new IPFIX IEs
>     together with the existing IPFIX IEs to detect specific DDoS attacks.
>
>                                                                                    
>
>
> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
> _______________________________________________
> Dots mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dots