[Idr] New draft-khare-idr-bgp-flowspec-payload-match-07

["Bergeon, Philippe (Nokia - CA/Ottawa)" <[e-mail]>]

All,

We published a new draft with draft-khare-idr-bgp-flowspec-payload-match version 07.

This new draft specifies a new Flowspec component, the "Flexible Match Conditions", which is used to define a pattern value and offset within a packet. One of the main goal of this new component is to further help mitigate DDoS attacks.

We would appreciate your review and comments.

Thanks,
Philippe.

-----Original Message-----
From: [e-mail] <[e-mail]> 

A new version of I-D, draft-khare-idr-bgp-flowspec-payload-match-07.txt
has been successfully submitted by Anurag Khare and posted to the IETF repository.

Name:		draft-khare-idr-bgp-flowspec-payload-match
Revision:	07
Title:		BGP FlowSpec Payload Matching
Document date:	2020-08-31
Group:		Individual Submission
Pages:		12
URL:            https://www.ietf.org/internet-drafts/draft-khare-idr-bgp-flowspec-payload-match-07.txt
Status:         https://datatracker.ietf.org/doc/draft-khare-idr-bgp-flowspec-payload-match/
Htmlized:       https://tools.ietf.org/html/draft-khare-idr-bgp-flowspec-payload-match-07
Htmlized:       https://datatracker.ietf.org/doc/html/draft-khare-idr-bgp-flowspec-payload-match
Diff:           https://www.ietf.org/rfcdiff?url2=draft-khare-idr-bgp-flowspec-payload-match-07

Abstract:
   The rise in frequency, volume, and pernicious effects of DDoS attacks
   has elevated them from fare for the specialist to generalist press.
   Numerous reports detail the taxonomy of DDoS attacks, the varying
   motivations of their attackers, as well as the resulting impact for
   their targets ranging from internet or business services to network
   infrastrutures.

   BGP FlowSpec (RFC 5575, "Dissemination of Flow Specification Rules")
   can be used to rapidly disseminate filtering rules to mitigate
   (distributed) denial-of-service (DoS) attacks.  Operators can use
   existing FlowSpec components to match typical n-tuple criteria in
   pre-defined packet header fields such as IP protocol, IP prefix or
   port number.  Recent enhancements to IP Router forwarding plane
   filter implementations also allow matches at arbitrary locations
   within the packet header or payload.  This capability can be used to
   essentially match a signature for the attack traffic and can be
   combined with traditional n-tuple filter criteria to mitigate
   volumetric DDoS attacks and reduce false positive to a minimum.

   To support this new filtering capability we define a new FlowSpec
   component, "Flexible Match Conditions", with similar matching
   semantics to those of existing components.  This component will allow
   the operator to define a new match condition using a combination of
   offset and pattern values.

                                                                                  


Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat