Re: [Dots] DOTS Telemetry

[Ehud Doron <[e-mail]>]

All

My personal thought about the DOT Telemetry  (and I am speaking for myself, not for the other DOTS Telemetry draft authors) is that in order to build a viable anti-DoS service, both NOC / SOC teams at client and server side will definitely need some sort of information about the on-going attack being mitigated. No doubt about that.

When it comes to operations of DDoS attacks, "life can be complicated" in the sense that attacks are not always successfully mitigated and cases of blocking legitimate traffic can be frequent.... Therefore I believe that the so called "Telemetry for Visibility" is mandatory, for some extent. Meaning that information about attacks (whether we call it telemetry or use other terminology) need to be presented to the SOC/NOC teams, and we MUST deal with it as an MVP. I think that what Tiru has suggested in the Signal Channel draft can be a very good starting point.

My concerns are that if such information will not be covered as part of DOTS standard, we will end up with a lot of vendor extensions and other "out of band" proprietary signaling... and I don't think that this is the ultimate goal of IETF in general and in particular for DOTS.

As per the "Telemetry for Mitigation" below, I have some concerns that this part might be more complicated and can tend to be aligned with a specific implementation, thus can be difficult to standardized. Therefore I think that this part can be considered in the future phases of DOTS.

Thanks,
Ehud Doron |  Senior Architect, Radware CTO office | M: [phone] | T: [phone]



From: Ehud Doron
Sent: Thursday, February 16, 2017 4:44 PM
To: 'dots' <[e-mail]>
Subject: DOTS Telemetry

All

Following the WG last F2F meeting in Seoul, we would like to elaborate the discussion about the DOTS Telemetry, mainly its general aspects and directives.

Up to now, we have two declarations for DOTS Telemetry:

1.       The DOTS Requirement draft draft-ietf-dots-requirements-03d defines : "DDoS attack telemetry:  Collected behavioral characteristics defining the nature of a DDoS attack. " .

2.       The DOTS Telemetry draft draft-doron-dots-telemetry-00  defines  ""DOTS Telemetry" is defined as the collection of attributes characterizing the actual attacks that have been detected and mitigated. The DOTS Telemetry is an optional set of attributes that can be signaled in the various DOTS protocol messages. The DOTS Telemetry can be optionally sent from the DOTS Client to Server and vice versa.

We are now figuring out the general view on the DOTS Telemetry theme and have mapped two main categorizes of telemetry we believe are most relevant to DOTS:


1.       Telemetry for Visibility - The main objectives of this category is to allow SOC / NOC teams, on both DOTS Client and Server side, to gain visibility on the overall service provided by facilitating the DOTS signaling. As perceptible examples, we can suggest the Mitigation Status requirement (OP-004 from DOTS Requirement draft), attack details, attack BW and PPS, packet / bytes drops and so on.



2.       Telemetry for Mitigation - The main objective of this category is to allow mitigation facilities to improve their detection and mitigation performance. As perceptible examples, we can suggest the Mitigation Efficacy requirement (OP-007 from DOTS Requirement draft), traffic baseline in certain levels and so on.

As part of the WG effort to define the DOTS baseline features (the DOTS MVPs), we would like to get the WG feedbacks about the abovementioned telemetry categories and also about other possible suggested telemetry categories. We encourage group members from both vendors and service providers to bring-in their valuable feedbacks and needs on this matter. It is preferable for us to get feedbacks on the suggested categories as a whole, rather than on a specific telemetry attribute within a specific category.

The main objective is allowing us to be able to direct, and focus, our work on draft-doron-dots-telemetry-00  according the WG directives and needs.

Kindly, we will appreciate any kind of feedbacks,

DOTS Telemetry draft authors