[Dots] Comments for draft-hayashi-dots-dms-offload

["Panwei (William)" <[e-mail]>]

Hi Yuhei,

In the IETF 105 meeting, there wasn’t enough time to discuss your draft, so I put my comments here for more discussion.
My comments are all about the ‘Signaling Method and Conveyed Information’ for different Attacks. The following figure is copied from your draft.
  +-------------+-----------------------------------+------------------+
  |             |        Reflection Attack          |  Non-Reflection  |
  |             |                                   |     Attack       |
  +-------------+-----------------------------------+------------------+
 | Out-of-band | Attack Time                                          |
  |     case    | Method : Data Channel                                |
  |             | Info : src_ip, src_port, dst_ip, dst_port, protocol  |
  +-------------+-----------------------------------+------------------+
  |   In-band   | Attack Time                       | Attack Time      |
  |    case     | (Number of reflector is small)    | Method : Signal  |
  |             | Method : Signal Channel with src  |          Channel |
  |             | Info : src_ip, src_port,          | Info : dst_ip,   |
  |             |        dst_ip, protocol           |        dst_port, |
  |             +-----------------------------------+        protocol  |
  |             | Attack Time                       |                  |
  |             | (Number of reflector is enormous) |                  |
  |             | Method : Signal Channel with src  |                  |
  |             | Info : src_port, dst_ip, protocol |                  |
  |             +-----------------------------------+------------------+
  |             | Peace Time                        | Peace Time       |
  |             | Method : Data Channel             | Method : Data    |
  |             | Info : src_port,                  |          Channel |
  |             |        dst_ip, protocol           | Info : dst_ip,   |
  |             |                                   |        dst_port, |
  |             |                                   |        protocol  |
  |             |                                   |                  |
  |             | Attack Time                       | Attack Time      |
  |             | Method : Signal Channel           | Method : Signal  |
  |             |          Control Filtering        |          Channel |
  |             | Info : ACL name                   | Control Filtering|
  |             |                                   | Info : ACL name  |
  |-------------+------------------------------------------------------+

1. For ‘In-band Case’ and ‘Attack Time’, ‘dst_port’ is conveyed for ‘Non-Reflection Attack’ and isn’t for ‘Reflection Attack’, so I infer that maybe a lot of or even all ports will be attacked on ‘Reflection Attack’ so you can’t or don’t need to convey ‘dst_port’. Also I noticed that non source attribute is conveyed on ‘Non-Reflection Attack’. So, different kinds of information are conveyed in different situations, but I didn’t find any references for your conclusions, can you give some references or descriptions to explain how you get the conclusions?
2. For ‘Reflection Attack’, ‘In-band Case’ and ‘Attack Time’, you give two methods based on the number of reflector, what I’m confused is how to distinguish whether the number is small or enormous. I think the comparison is a very subjective thing, different people may have different understanding, so I don’t know whether it’s suitable or common to just say the number is small or enormous.
3. For ‘In-band Case’ and ‘Peace Time’, you want to send the ACLs by Data Channel before the attack, and activate them by Signal Channel during attack. But how do you know the targets and attack sources before the attack, especially the DMS may be in charge of the whole network?

Regards & Thanks!
潘伟 Wei Pan
华为技术有限公司 Huawei Technologies Co., Ltd.