Re: [Dots] 答复: Hi, authors. 3 comments:

[<[e-mail]>]

Re-,

Please see inline.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
Envoyé : mercredi 6 mars 2019 10:41
À : BOUCADAIR Mohamed TGI/OLN; Xialiang (Frank, Network Standard & Patent Dept); kaname nishizuka; [e-mail]
Cc : [e-mail]
Objet : RE: [Dots] 答复: Hi, authors. 3 comments:

Hi Med,

Please see inline [TR2]

From: [e-mail] <[e-mail]>
Sent: Wednesday, March 6, 2019 1:17 PM
To: Konda, Tirumaleswar Reddy <[e-mail]>; Xialiang (Frank, Network Standard & Patent Dept) <[e-mail]>; kaname nishizuka <[e-mail]>; [e-mail]
Cc: [e-mail]
Subject: RE: [Dots] 答复: Hi, authors. 3 comments:


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


________________________________
Hi Tiru,

Please see inline.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[e-mail]]
Envoyé : mercredi 6 mars 2019 07:47
À : Xialiang (Frank, Network Standard & Patent Dept); BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; [e-mail]<mailto:[e-mail]>
Cc : [e-mail]<mailto:[e-mail]>
Objet : RE: [Dots] 答复: Hi, authors. 3 comments:

Hi Kaname,

Please see inline

When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks).
Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic.

[TR] Agreed, but once the DDoS Mitigator starts scrubbing incoming traffic, attack traffic will be dropped and mitigation updates from the DOTS server will reach the DOTS client.
[Med] Agree.

It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel.

[TR] If all of the incoming traffic is rate-limited, both good and bad traffic will be dropped and may not be acceptable.
[Med] Only the traffic matching the ACL will be rate-limited. Of course, that acl may be defined to cover all the traffic. This scenario is basically as follows:

•         Detect suspicious traffic in a client domain

•         Send a first mitigation with a wide scope + activate some ACLs. Which acls to activate is deployment-specific.

•         Later, send a second mitigation request with an adjusted scope.

[TR2] If the DOTS client knows the target resource, why send the mitigation request for wide scope ?
[Med] The assumption is it does not know the exact “scope”.
           If the DOTS client does not know the target resource, how can it adjust the scope in the second mitigation request ?
[Med] It will conclude that as the attack is progressing.
            I don’t understand how the rate-limit ACL is useful in this case ?
[Med] We don’t need to focus on the rate-limit. I guess Kaname provided that as an example. The ACL can activate an accept-list or whatever actions is judged adequate by the client. I don’t think that we are introducing here a new use case. All these pieces are already covered/allowed by existing specs.

-Tiru

Then, it will send mitigation request to the DOTS server.

[TR] The mitigation request can also enable the ACL (set by data-channel), I don’t get the reason to send the mitigation request again.
[Med] This is required to adjust the scope. A new request is needed.

This kind of procedure is really used by manual operation. Combination of ACL-based filtering and mitigation appliance is cost effective.
The proposed draft (signal-control-filtering) enable automation of it.

Cheers,
-Tiru

From: Dots <[e-mail]<mailto:[e-mail]>> On Behalf Of Xialiang (Frank, Network Standard & Patent Dept)
Sent: Tuesday, March 5, 2019 4:09 PM
To: [e-mail]<mailto:[e-mail]>; kaname nishizuka <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [Dots] 答复: Hi, authors. 3 comments:


CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


________________________________
Hi Med,
Thanks for the clarification, we are on the same page now.

B.R.
Frank

发件人: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]]
发送时间: 2019年3月5日 18:30
收件人: kaname nishizuka <[e-mail]<mailto:[e-mail]>>; Xialiang (Frank, Network Standard & Patent Dept) <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
抄送: [e-mail]<mailto:[e-mail]>
主题: RE: [Dots] Hi, authors. 3 comments:

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

De : Dots [mailto:[e-mail]] De la part de kaname nishizuka
Envoyé : mardi 5 mars 2019 09:01
À : Xialiang (Frank, Network Standard & Patent Dept); [e-mail]<mailto:[e-mail]>
Cc : [e-mail]<mailto:[e-mail]>
Objet : Re: [Dots] Hi, authors. 3 comments:

Hi Frank,
On 2019/03/05 15:26, Xialiang (Frank, Network Standard & Patent Dept) wrote:
Hi authors,
I have 3 general comments as below:

1.       Can you clarify the DOTS server administrative domain a little bit? What is the goal we define it?
We'll clarify it and update the draft.


[Med] This is what is called “DOTS server domain” in DOTS drafts. The notion of “administrative domain” is already used/discussed in the arch I-D.



2.       Will this document open a door to make signal channel to cover the functions of data channel more and more?

[Med] No. We do already have this text:



   A DOTS client MUST NOT use the filtering control over DOTS signal

   channel if no attack (mitigation) is active; such requests MUST be

   discarded by the DOTS server with 4.00 (Bad Request).  By default,

   ACL-related operations are achieved using the DOTS data channel

   [I-D.ietf-dots-data-channel<https://tools.ietf.org/html/draft-nishizuka-dots-signal-control-filtering-04#ref-I-D.ietf-dots-data-channel>] when no attack is ongoing.



The draft focuses only on tweaking the status of **existing** filters.



3.       I can accept the situation of changing the accept-list to the “deactivate” status, but is it a common use case we need to change a deny-list to the “immediate” status?
Regarding with 2 and 3, I can add one usecase to the draft.
When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks).
Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic.
It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel.
Then, it will send mitigation request to the DOTS server.
This kind of procedure is really used by manual operation. Combination of ACL-based filtering and mitigation appliance is cost effective.
The proposed draft (signal-control-filtering) enable automation of it.

regards,
Kaname


Thanks!


B.R.
Frank