Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-telemetry-00.txt

[kaname nishizuka <[e-mail]>]

Hi Jon,

Please see inline.

On 2019/07/23 18:29, Jon Shallow wrote:
>
> Hi Kaname,
>
> “When an attack occur, the DDoS detection system will notice that the customer is under attack, then the pre-mitigation DOTS telemetry(= attack details) can be signaled from the DOTS server to the (associated) DOTS client”
>
> How is the DOTS telemetry information signalled/pushed from the DOTS server to the DOTS client?
>
[kaname]Yes, that is the question. I think it should be discussed in the meeting with regard to the telemetry I-D.


> Can it be assumed that a mitigation request is already active from the DOTS client and the telemetry update is piggybacked on a mitigation observe response?
>
[kaname]No. Currently the notification (via e-mail etc...) is done before any mitigation request.
If we allowed a dummy mitigation request for that observation purpose, it could be yes. (I don't think it's a good strategy)


> Is it down to the client doing a periodic poll of a (potentially new) resource?
>
[kaname]It could be one solution, however I'd like to seek a way with push notification.


> [The call home concept could cover this, but the client and server roles need to be clearly defined with possibly a client and server being resident in each peer]
>
[kaname] Yes, the telemetry I-D is covering the information exchange in both directions(server->client, client->server). Then I think it's a typical deployment for ISPs and mobile carriers that the DOTS server is in the provider's network and the DOTS client in the customer's network, as Meiling agreed with the usecase.

thanks,
Kaname
>
> Regards
>
> Jon
>
> *From:*Dots [mailto: [e-mail]] *On Behalf Of *Konda, Tirumaleswar Reddy
> *Sent:* 23 July 2019 08:04
> *To:* kaname nishizuka; tirumal reddy; [e-mail]
> *Subject:* Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-telemetry-00.txt
>
> Thanks for the clarification. I don’t think any of the DOTS use cases documents discuss this deployment. DOTS signal channel looks more suitable for these Pre-mitigation DOTS Telemetry Attributes than the DOTS data channel.
>
> Cheers,
>
> -Tiru
>
> *From:*kaname nishizuka <[e-mail]>
> *Sent:* Monday, July 22, 2019 8:26 PM
> *To:* Konda, Tirumaleswar Reddy <[e-mail]>; tirumal reddy <[e-mail]>; [e-mail]
> *Subject:* Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-telemetry-00.txt
>
> *CAUTION*:External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Hi Tiru,
>
> Let me explain it.
> There is a service by several transit providers such as detection capabilities to notify clients of potential attacks.
> It is assumed that they have a DDoS mitigation system and a DDoS detection system (for example, a flow collector) separately.
> It is a realistic deployment that the DOTS server is integrated with the flow collector.
>
> When an attack occur, the DDoS detection system will notice that the customer is under attack, then the pre-mitigation DOTS telemetry(= attack details) can be signaled from the DOTS server to the (associated) DOTS client.
>
> Here is one of the traffic anomaly detection notification example (threshold basis) quoted from some actual service.
> Organization:       XXX
> Attack ID:          13227
> Start Time:         2019/06/05 22:52:30 JST+0900
> Level:              1
> Traffic Amount:     4.02k pps
> Threshold:          4.00k pps
> Direction:          incoming
> Victim IP Address:  x.x.x.x/32
> Attack Type:        TCP SYN
>
> It says like "it seems you're under attack, what will you do? (We can offer some protection)"
>
> regards,
> Kaname
>
> On 2019/07/22 23:11, Konda, Tirumaleswar Reddy wrote:
>
>     Thanks Kaname for the support. I did not get the comment. what type of pre-mitigation DOTS telemetry attributes can be signaled from the DOTS server to the DOTS client ?
>
>     And How will the DOTS server know the pre-mitigation DOTS telemetry attributes relevant or associated with a DOTS client ?
>
>     Cheers,
>
>     -Tiru
>
>     *From:*Dots <[e-mail]> <mailto:[e-mail]> *On Behalf Of *kaname nishizuka
>     *Sent:* Monday, July 22, 2019 6:44 PM
>     *To:* tirumal reddy <[e-mail]> <mailto:[e-mail]>; [e-mail] <mailto:[e-mail]>
>     *Subject:* Re: [Dots] Fwd: New Version Notification for draft-reddy-dots-telemetry-00.txt
>
>     *CAUTION*:External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
>     ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>     I support this draft.
>
>     I'd like to mention about the telemetry attributes from a DOTS server to a DOTS client.
>     Currently, several transit ISPs are providing DDoS detection and protection services.
>     In such a service, they send a DDoS detection notification via e-mail when they noticed that their customer is under attack.
>     The mail includes the telemetry information such as 4.1.5. Attack Details.
>     This info can be used for further decision of protection strategy by the customer's security operators.
>     I think it should be covered by the DOTS telemetry specification.
>
>     One suggestion to the draft:
>     Pre-mitigation DOTS Telemetry Attributes can also be signaled from the DOTS server to the DOTS client.
>
>     thanks,
>     Kaname
>
>
>     On 2019/07/05 22:20, tirumal reddy wrote:
>
>         Hi all,
>
>         https://tools.ietf.org/html/draft-reddy-dots-telemetry-00 aims to enrich DOTS protocols with various telemetry attributes allowing optimal DDoS attack mitigation. This document specifies the normal traffic baseline and attack traffic telemetry attributes a DOTS client can convey to its DOTS server in the mitigation request, the mitigation status telemetry attributes a DOTS server can communicate to a DOTS client, and the mitigation efficacy telemetry attributes a DOTS client can communicate to a DOTS server. The telemetry attributes can assist the mitigator to choose the DDoS mitigation techniques and perform optimal DDoS attack mitigation.
>
>         Comments, suggestions, and questions are more than welcome.
>
>
>         Cheers,
>
>         -Tiru
>
>         ---------- Forwarded message ---------
>         From: <[e-mail] <mailto:[e-mail]>>
>         Date: Fri, 5 Jul 2019 at 18:44
>         Subject: New Version Notification for draft-reddy-dots-telemetry-00.txt
>         To: Tirumaleswar Reddy <[e-mail] <mailto:[e-mail]>>, Ehud Doron <[e-mail] <mailto:[e-mail]>>, Mohamed Boucadair <[e-mail] <mailto:[e-mail]>>
>
>
>
>
>         A new version of I-D, draft-reddy-dots-telemetry-00.txt
>         has been successfully submitted by Tirumaleswar Reddy and posted to the
>         IETF repository.
>
>         Name:           draft-reddy-dots-telemetry
>         Revision:       00
>         Title:          Distributed Denial-of-Service Open Threat Signaling (DOTS) Telemetry
>         Document date:  2019-07-05
>         Group:          Individual Submission
>         Pages:          13
>         URL: https://www.ietf.org/internet-drafts/draft-reddy-dots-telemetry-00.txt
>         Status: https://datatracker.ietf.org/doc/draft-reddy-dots-telemetry/
>         Htmlized: https://tools.ietf.org/html/draft-reddy-dots-telemetry-00
>         Htmlized: https://datatracker.ietf.org/doc/html/draft-reddy-dots-telemetry
>
>
>         Abstract:
>            This document aims to enrich DOTS signal channel protocol with
>            various telemetry attributes allowing optimal DDoS attack mitigation.
>            This document specifies the normal traffic baseline and attack
>            traffic telemetry attributes a DOTS client can convey to its DOTS
>            server in the mitigation request, the mitigation status telemetry
>            attributes a DOTS server can communicate to a DOTS client, and the
>            mitigation efficacy telemetry attributes a DOTS client can
>            communicate to a DOTS server.  The telemetry attributes can assist
>            the mitigator to choose the DDoS mitigation techniques and perform
>            optimal DDoS attack mitigation.
>
>
>
>
>         Please note that it may take a couple of minutes from the time of submission
>         until the htmlized version and diff are available at tools.ietf.org <http://tools.ietf.org>.
>
>         The IETF Secretariat
>
>
>
>         _______________________________________________
>
>         Dots mailing list
>
>         [e-mail] <mailto:[e-mail]>
>
>         https://www.ietf.org/mailman/listinfo/dots
>
>     _______________________________________________
>
>     Dots mailing list
>
>     [e-mail] <mailto:[e-mail]>
>
>     https://www.ietf.org/mailman/listinfo/dots
>
>
> _______________________________________________
> Dots mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dots