Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-telemetry-00.txt

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: H Y <[e-mail]>
> Sent: Wednesday, July 24, 2019 7:26 PM
> To: Konda, Tirumaleswar Reddy <[e-mail]>
> Cc: Mohamed Boucadair <[e-mail]>; tirumal reddy
> <[e-mail]>; [e-mail]
> Subject: Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-
> telemetry-00.txt
> 
> This email originated from outside of the organization. Do not click links or
> open attachments unless you recognize the sender and know the content is
> safe.
> 
> Hi Tiru
> 
> > What is stopping the attacker to frequently change the IP address
> (especially with IPv6) ?
> > What kind of attack traffic is generated by the top talkers and what
> happens if the top talkers are spoofed IP addresses (e.g. amplification
> attack) ?
> IMO, when a reflection attack hits a target, src_ip address detected at the
> target are reflectors ip address.
> If the reflector's ip does not change frequently, the top talker information
> can be used.
> Is it wrong?

Yes, the reflector becomes the victim in this attack and cannot access the services of the target server. For example, consider an attack scenario where the surveillance IP camera's IP address is spoofed and it no longer can send feeds to its server (and the attacker can successfully launch a physical attack (e.g. home burglary)).

Cheers,
-Tiru

> 
> Thanks,
> Yuhei
> 
> 2019年7月24日(水) 9:37 Konda, Tirumaleswar Reddy
> <[e-mail]>:
> >
> > Hi Yuhei,
> >
> > What is stopping the attacker to frequently change the IP address
> (especially with IPv6) ?
> > What kind of attack traffic is generated by the top talkers and what
> happens if the top talkers are spoofed IP addresses (e.g. amplification
> attack) ?
> >
> > Cheers,
> > -Tiru
> >
> > > -----Original Message-----
> > > From: H Y <[e-mail]>
> > > Sent: Wednesday, July 24, 2019 6:57 PM
> > > To: Mohamed Boucadair <[e-mail]>
> > > Cc: Konda, Tirumaleswar Reddy
> <[e-mail]>;
> > > tirumal reddy <[e-mail]>; [e-mail]
> > > Subject: Re: [Dots] Fwd: New Version Notification for
> > > draft-reddy-dots- telemetry-00.txt
> > >
> > >
> > >
> > > Hi Med,
> > >
> > > > [Med] Yes. My point is if one has to return a list of top-talkers
> > > > in terms of
> > > pps, another list of top-talkers in terms of second_criteria, or
> > > other information relying on source-prefix dedicated attributes will
> > > be needed because this cannot be inferred from the current source-
> prefix attribute.
> > > [hayashi] +1. This top-talker information is helpful for the
> > > orchestrator to decide which attack traffic should be blocked
> > > preferentially in network. The criteria information is also needed.
> > >
> > > Thanks,
> > > Yuhei
> > >
> > > 2019年7月24日(水) 8:56 <[e-mail]>:
> > > >
> > > > Re-,
> > > >
> > > > Please see inline.
> > > >
> > > > Cheers,
> > > > Med
> > > >
> > > > > -----Message d'origine-----
> > > > > De : Konda, Tirumaleswar Reddy
> > > > > [mailto:[e-mail]]
> > > > > Envoyé : mercredi 24 juillet 2019 14:45 À : BOUCADAIR Mohamed
> > > > > TGI/OLN; H Y; tirumal reddy Cc : [e-mail] Objet : RE:
> > > > > [Dots]
> > > > > Fwd: New Version Notification for draft-reddy-dots-
> > > > > telemetry-00.txt
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: [e-mail]
> > > <[e-mail]>
> > > > > > Sent: Wednesday, July 24, 2019 6:02 PM
> > > > > > To: Konda, Tirumaleswar Reddy
> > > > > > <[e-mail]>; H Y
> > > > > > <[e-mail]>; tirumal reddy <[e-mail]>
> > > > > > Cc: [e-mail]
> > > > > > Subject: RE: [Dots] Fwd: New Version Notification for
> > > > > > draft-reddy-dots- telemetry-00.txt
> > > > > >
> > > > > > This email originated from outside of the organization. Do not
> > > > > > click
> > > > > links or
> > > > > > open attachments unless you recognize the sender and know the
> > > > > > content is safe.
> > > > > >
> > > > > > Hi Tiru,
> > > > > >
> > > > > > That’s true...but fragmentation is a general issue each time
> > > > > > we need to supply more telemetry information in the signal channel.
> > > > > > As already
> > > > > noted in
> > > > > > the draft, we will need to figure out when it is better to
> > > > > > provide some telemetry information using data channel.
> > > > >
> > > > > Yes, normal traffic baseline attributes can be conveyed in the
> > > > > DOTS data channel and traffic from top talkers can also be
> > > > > blocked/rate-limited using the DOTS data channel during peace time.
> > > > >
> > > > > >
> > > > > > BTW, "top talker" can already be supplied using source-prefix
> attribute.
> > > > > > Whether top-talker needs to be defined as a separated
> > > > > > attribute, but structured as a list of source-prefixes is a
> > > > > > design details (if the WG
> > > > > agrees to
> > > > > > include it in the telemetry information).
> > > > >
> > > > > Source-prefix is already a list/array.
> > > >
> > > > [Med] Yes. My point is if one has to return a list of top-talkers
> > > > in terms of
> > > pps, another list of top-talkers in terms of second_criteria, or
> > > other information relying on source-prefix dedicated attributes will
> > > be needed because this cannot be inferred from the current source-
> prefix attribute.
> > > >
> > > > >
> > > > > >
> > > > > > Anyway, let's continue collecting candidate telemetry
> > > > > > information and
> > > > > then
> > > > > > make a selection in a second phase.
> > > > >
> > > > > Sure.
> > > > >
> > > > > Cheers,
> > > > > -Tiru
> > > > >
> > > > > >
> > > > > > Cheers,
> > > > > > Med
> > > > > >
> > > > > > > -----Message d'origine-----
> > > > > > > De : Dots [mailto:[e-mail]] De la part de
> > > > > > > Konda, Tirumaleswar Reddy Envoyé : mercredi 24 juillet 2019
> > > > > > > 14:18 À : H Y; tirumal reddy Cc : [e-mail] Objet : Re:
> > > > > > > [Dots] Fwd: New Version Notification for draft-reddy-dots-
> > > > > > > telemetry-00.txt
> > > > > > >
> > > > > > > Hi Yuhei,
> > > > > > >
> > > > > > > Thanks for the support. The problem is fragmentation of the
> > > > > > > DOTS telemetry message, DOTS Telemetry is sent over the DOTS
> > > > > > > signal channel using UDP and the message size cannot exceed
> PMTU.
> > > > > > >
> > > > > > > Cheers,
> > > > > > > -Tiru
> > > > > > >
> > > > > > > > -----Original Message-----
> > > > > > > > From: Dots <[e-mail]> On Behalf Of H Y
> > > > > > > > Sent: Tuesday, July 23, 2019 5:28 PM
> > > > > > > > To: tirumal reddy <[e-mail]>
> > > > > > > > Cc: [e-mail]
> > > > > > > > Subject: Re: [Dots] Fwd: New Version Notification for
> > > > > > > > draft-reddy-dots- telemetry-00.txt
> > > > > > > >
> > > > > > > > This email originated from outside of the organization. Do
> > > > > > > > not click
> > > > > > > links or
> > > > > > > > open attachments unless you recognize the sender and know
> > > > > > > > the content is safe.
> > > > > > > >
> > > > > > > > Hi Tiru,
> > > > > > > >
> > > > > > > > I read the draft and I also support this draft.
> > > > > > > > Sending detail information about attack traffic helps my
> > > > > > > > dms offload
> > > > > > > scenario
> > > > > > > > because the orchestrator can decide what to do based on
> > > > > > > > the detail information.
> > > > > > > >
> > > > > > > > IMO, "top talker" attribute defined in my previous draft
> > > > > > > > is also
> > > > > > > feasible to
> > > > > > > > send and effective to mitigate attack correctly.
> > > > > > > > https://datatracker.ietf.org/doc/draft-h-dots-mitigation-o
> > > > > > > > fflo
> > > > > > > > ad-
> > > > > > > expansion/
> > > > > > > > What do you think about including the top talker attribute
> > > > > > > > to the
> > > > > > > telemetry?
> > > > > > > >
> > > > > > > > Thanks,
> > > > > > > > Yuhei
> > > > > > > >
> > > > > > > > 2019年7月5日(金) 9:21 tirumal reddy <[e-mail]>:
> > > > > > > > >
> > > > > > > > > Hi all,
> > > > > > > > >
> > > > > > > > > https://tools.ietf.org/html/draft-reddy-dots-telemetry-0
> > > > > > > > > 0
> > > > > > > > > aims to
> > > > > > > enrich
> > > > > > > > DOTS protocols with various telemetry attributes allowing
> > > > > > > > optimal DDoS attack mitigation. This document specifies
> > > > > > > > the normal traffic baseline
> > > > > > > and
> > > > > > > > attack traffic telemetry attributes a DOTS client can
> > > > > > > > convey to its DOTS
> > > > > > > server
> > > > > > > > in the mitigation request, the mitigation status telemetry
> > > > > > > > attributes a
> > > > > > > DOTS
> > > > > > > > server can communicate to a DOTS client, and the
> > > > > > > > mitigation efficacy telemetry attributes a DOTS client can
> > > > > > > > communicate to a
> > > DOTS server.
> > > > > > > The
> > > > > > > > telemetry attributes can assist the mitigator to choose
> > > > > > > > the DDoS
> > > > > > > mitigation
> > > > > > > > techniques and perform optimal DDoS attack mitigation.
> > > > > > > > >
> > > > > > > > > Comments, suggestions, and questions are more than
> welcome.
> > > > > > > > >
> > > > > > > > > Cheers,
> > > > > > > > > -Tiru
> > > > > > > > >
> > > > > > > > > ---------- Forwarded message ---------
> > > > > > > > > From: <[e-mail]>
> > > > > > > > > Date: Fri, 5 Jul 2019 at 18:44
> > > > > > > > > Subject: New Version Notification for
> > > > > > > > > draft-reddy-dots-telemetry-00.txt
> > > > > > > > > To: Tirumaleswar Reddy <[e-mail]>, Ehud Doron
> > > > > > > > > <[e-mail]>, Mohamed Boucadair
> > > > > > > > <[e-mail]>
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > A new version of I-D, draft-reddy-dots-telemetry-00.txt
> > > > > > > > > has been successfully submitted by Tirumaleswar Reddy
> > > > > > > > > and posted to the IETF repository.
> > > > > > > > >
> > > > > > > > > Name:           draft-reddy-dots-telemetry
> > > > > > > > > Revision:       00
> > > > > > > > > Title:          Distributed Denial-of-Service Open Threat
> > > > > Signaling
> > > > > > > (DOTS)
> > > > > > > > Telemetry
> > > > > > > > > Document date:  2019-07-05
> > > > > > > > > Group:          Individual Submission
> > > > > > > > > Pages:          13
> > > > > > > > > URL:            https://www.ietf.org/internet-drafts/draft-reddy-
> > > > > dots-
> > > > > > > > telemetry-00.txt
> > > > > > > > > Status:         https://datatracker.ietf.org/doc/draft-reddy-dots-
> > > > > > > telemetry/
> > > > > > > > > Htmlized:       https://tools.ietf.org/html/draft-reddy-dots-
> > > > > > > telemetry-00
> > > > > > > > > Htmlized:       https://datatracker.ietf.org/doc/html/draft-
> reddy-
> > > > > > > dots-
> > > > > > > > telemetry
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Abstract:
> > > > > > > > >    This document aims to enrich DOTS signal channel protocol
> with
> > > > > > > > >    various telemetry attributes allowing optimal DDoS
> > > > > > > > > attack
> > > > > > > mitigation.
> > > > > > > > >    This document specifies the normal traffic baseline and
> attack
> > > > > > > > >    traffic telemetry attributes a DOTS client can convey
> > > > > > > > > to its
> > > > > DOTS
> > > > > > > > >    server in the mitigation request, the mitigation
> > > > > > > > > status
> > > > > telemetry
> > > > > > > > >    attributes a DOTS server can communicate to a DOTS
> > > > > > > > > client, and
> > > > > the
> > > > > > > > >    mitigation efficacy telemetry attributes a DOTS client can
> > > > > > > > >    communicate to a DOTS server.  The telemetry
> > > > > > > > > attributes can
> > > > > assist
> > > > > > > > >    the mitigator to choose the DDoS mitigation
> > > > > > > > > techniques and
> > > > > perform
> > > > > > > > >    optimal DDoS attack mitigation.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > Please note that it may take a couple of minutes from
> > > > > > > > > the time of submission until the htmlized version and
> > > > > > > > > diff are available at
> > > > > > > tools.ietf.org.
> > > > > > > > >
> > > > > > > > > The IETF Secretariat
> > > > > > > > >
> > > > > > > > > _______________________________________________
> > > > > > > > > Dots mailing list
> > > > > > > > > [e-mail]
> > > > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > --
> > > > > > > > ----------------------------------
> > > > > > > > Yuuhei HAYASHI
> > > > > > > > 08065300884
> > > > > > > > [e-mail]
> > > > > > > > [e-mail]
> > > > > > > > ----------------------------------
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Dots mailing list
> > > > > > > > [e-mail]
> > > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > > > > > > _______________________________________________
> > > > > > > Dots mailing list
> > > > > > > [e-mail]
> > > > > > > https://www.ietf.org/mailman/listinfo/dots
> > >
> > >
> > >
> > > --
> > > ----------------------------------
> > > Yuuhei HAYASHI
> > > 08065300884
> > > [e-mail]
> > > [e-mail]
> > > ----------------------------------
> 
> 
> 
> --
> ----------------------------------
> Yuuhei HAYASHI
> 08065300884
> [e-mail]
> [e-mail]
> ----------------------------------