Re: [Dots] draft-ietf-dots-signal-channel-33: trigger-mitigation

["Panwei (William)" <[e-mail]>]

Hi Meiling,

I think this design is used for the case that DOTS server fails to receive a real-time mitigation request from DOTS client during attack time.
The mitigation request with trigger-mitigation set to false is a pre-configured mitigation request, it is sent before a DDoS attack happens. When DOTS server receives such mitigation request, it just saves this request and won’t trigger mitigation immediately.
When the DDoS attack really happens, the DOTS server may receive no messages from DOTS client because the link is congested by attack traffic, then the pre-configured mitigation request will be triggered when DOTS server considers the session is lost. Without this pre-configured mitigation request, the DDoS attack won’t be mitigated at this time.
So I don’t think it is “almost never used”.

Best Regards
Wei Pan

From: Dots [mailto:[e-mail]] On Behalf Of MeiLing Chen
Sent: Thursday, May 16, 2019 10:36 AM
To: mohamed.boucadair <[e-mail]>; Konda, Tirumaleswar Reddy <[e-mail]>
Cc: dots <[e-mail]>
Subject: Re: [Dots] draft-ietf-dots-signal-channel-33: trigger-mitigation

Hi Med,
It looks like that trigger-mitigation set to false almost never used unless session is lost and then the DOTS client initiate another mitigation request with the trigger-mitigation value of false.


De : MeiLing Chen [mailto:[e-mail]]
Envoyé : mercredi 15 mai 2019 12:17
À : Konda, Tirumaleswar Reddy; BOUCADAIR Mohamed TGI/OLN
Cc : dots
Objet : draft-ietf-dots-signal-channel-33: trigger-mitigation



Hi Tiru, Med;

I read draft-ietf-dots-signal-channel-33, I have a question about the parameter of trigger-mitigation,


 trigger-mitigation:   If the parameter value is set to 'false', DDoS

      mitigation will not be triggered for the mitigation request unless

      the DOTS signal channel session is lost.

      If the DOTS client ceases to respond to heartbeat messages, the

      DOTS server can detect that the DOTS signal channel session is

      lost.  More details are discussed in Section 4.7.

Reddy, et al.           Expires November 11, 2019              [Page 18]

Internet-Draft        DOTS Signal Channel Protocol              May 2019

      The default value of the parameter is 'true' (that is, the

      mitigation starts immediately).  If 'trigger-mitigation' is not

      present in a request, this is equivalent to receiving a request

      with 'trigger-mitigation' set to 'true'.
question1: When send mitigation request first time, trigger-mitigation is set true; when session is lost, trigger-mitigation set false will work, so how to know session is lost?
[Med] the absence of traffic or replies to server-initiated heartbeats are used to that aim. This covered by this text in the spec:

      If the DOTS server does not receive any traffic from the peer DOTS
      client, then the DOTS server sends heartbeat requests to the DOTS
      client and after maximum 'missing-hb-allowed' threshold is
      reached, the DOTS server concludes the session is disconnected.
      The DOTS server can then trigger pre-configured mitigation
        requests for this DOTS client (if any).

question2: Why need this parameter and What was the initial requirements scenario?
[Med] Please check: https://tools.ietf.org/html/draft-ietf-dots-architecture-13#section-3.3.3