[Dots] Éric Vyncke's No Objection on draft-ietf-dots-telemetry-use-cases-14: (with COMMENT)

[Éric Vyncke via Datatracker <[e-mail]>]

Éric Vyncke has entered the following ballot position for
draft-ietf-dots-telemetry-use-cases-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dots-telemetry-use-cases/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


# Éric Vyncke, INT AD, comments for draft-ietf-shmoo-hackathon-07
CC @evyncke

Thank you for the work put into this document.

Please find below some non-blocking COMMENT points (but replies would be
appreciated even if only for my own education).

Special thanks to Valery Smyslov for the shepherd's detailed write-up including
the WG consensus *but* the justification of the intended status is missing.

I hope that this review helps to improve the document,

Regards,

-éric

## COMMENTS

### Timing of the WG docs

Like Alvaro wrote, it would have been nicer for the reviewer to have this
document published before RFC 9244 ;-)

### Section 3.1.1 report

`recently reported large DDoS attacks exceeded several Tbps` please provide an
informative reference to this report.

### Section 3.1.1 top-talkers

I am a little puzzled how an attack coming out of *two* top-talkers (and thanks
for using IPv6 examples :-) ) is a *distributed* DoS attack. Suggest to change
the prefix to something broader (e.g., two /48) rather than a host /128 prefix.

### Section 3.1.1 figure 1 e.g.

Is the use of "E.g.," in figures common ? or useful ? in figure 1 ?

As a side note, I am hard time to understand the figure 1: they are overloaded
and little explanations on the graphics are given.

### Section 3.1.5

The intro text is about DNS torture attack, but the DOTS example is about DNS
amplification attack, which appears as different attacks to me.

### Section 3.3.1

To be honest, the value of this section about ML escapes me ;-) (notably why
DOTS is helping here) but the example DOTS message would benefit of using
2001:db8::2/127 rather than the 2 /128 ;)

### Section 6

Like Murray, I also wonder why some reviews are labelled as IESG review ;-)

## Notes

This review is in the ["IETF Comments" Markdown format][ICMF], You can use the
[`ietf-comments` tool][ICT] to automatically convert this review into
individual GitHub issues.

[ICMF]: https://github.com/mnot/ietf-comments/blob/main/format.md
[ICT]: https://github.com/mnot/ietf-comments