[Dots] per target or aggregated ? RE: DOTS telemetry Issues picked up in Interop Testing
mohamed.boucadair@orange.com Tue, 21 April 2020 11:09 UTC
Return-Path: <mohamed.boucadair@orange.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 450403A0887 for <dots@ietfa.amsl.com>; Tue, 21 Apr 2020 04:09:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xB05GhokmRsc for <dots@ietfa.amsl.com>; Tue, 21 Apr 2020 04:09:41 -0700 (PDT)
Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.70.36]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D03F73A0882 for <dots@ietf.org>; Tue, 21 Apr 2020 04:09:40 -0700 (PDT)
Received: from opfednr04.francetelecom.fr (unknown [xx.xx.xx.68]) by opfednr24.francetelecom.fr (ESMTP service) with ESMTP id 49616p6nFyz1ySt; Tue, 21 Apr 2020 13:09:38 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1587467379; bh=ZBpFAQ3NXPPL/AH+v75hWe+CPzEw0mzdnzuh/MEJ4vg=; h=From:To:Subject:Date:Message-ID:Content-Type:MIME-Version; b=rit7QWyb1GjXL8N4j6eAtpl8RcTu5uN83Y9h9+X7wrjJzO8rmNpEtSoqa57wOh65A QLweAOAtVSVaVDYAHA42lMkWP6zVxeaCfc2+klfQuev2Z7mdGYOnDQmskOP0/BFucj fbDxo7IH14f4FPcLbmesyocRdvn7kAxvawygYZOYNPvsAscwtiZZUDbPZLI122d9GC khc+YKRiSP1dxL719MQKSSWICU4pO4WGdxu9IQRLXw4wq2z0fPxjknraklTj4JuPAu ktqFz/boZSSjanhqK8mNGYQkp3kMcuKou7oVljoEzb539AzVE2YiBuf4CzXnda49ra kxIwpC1Pwxzfg==
Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.45]) by opfednr04.francetelecom.fr (ESMTP service) with ESMTP id 49616p5qHZz1xpM; Tue, 21 Apr 2020 13:09:38 +0200 (CEST)
From: mohamed.boucadair@orange.com
To: Jon Shallow <supjps-ietf@jpshallow.com>, "dots@ietf.org" <dots@ietf.org>
Thread-Topic: per target or aggregated ? RE: [Dots] DOTS telemetry Issues picked up in Interop Testing
Thread-Index: AdYXzVNYJVRgDrWORXqS2nE1SG7+rg==
Date: Tue, 21 Apr 2020 11:09:37 +0000
Message-ID: <787AE7BB302AE849A7480A190F8B93303149B423@OPEXCAUBMA2.corporate.adroot.infra.ftgroup>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.114.13.245]
Content-Type: multipart/alternative; boundary="_000_787AE7BB302AE849A7480A190F8B93303149B423OPEXCAUBMA2corp_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/tMEbyNjiogPobhfImnuVQafd9uc>
Subject: [Dots] per target or aggregated ? RE: DOTS telemetry Issues picked up in Interop Testing
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Apr 2020 11:09:45 -0000
Re-, This is up to the server. The draft says: A DOTS server may aggregate pre-or-ongoing-mitigation data (e.g., 'top-talkers') for all targets of a domain, or when justified, send specific information (e.g., 'top-talkers') per individual targets. Cheers, Med De : Jon Shallow [mailto:supjps-ietf@jpshallow.com] Envoyé : mardi 21 avril 2020 12:56 À : BOUCADAIR Mohamed TGI/OLN; dots@ietf.org Objet : RE: [Dots] DOTS telemetry Issues picked up in Interop Testing Jon> Which then leads me on to something else. If we asking for telemetry for 2 (or more) different target IPs and the server is returning vendor specific attack details. For attack-detail, keyed by attack-id, if the same attack is hitting more than 1 target IP, can I display this information per IP or does it have to be aggregated?
- [Dots] per target or aggregated ? RE: DOTS teleme… mohamed.boucadair