[Idr] 答复: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

[Youjianjie <[e-mail]>]

Hi Gunter,

Yes, it could potentially be used for any type NLRI if having use cases and requirements for them. We haven’t analyzed those yet.

Thanks,
Jianjie

发件人: Gunter Van De Velde [mailto:[e-mail]]
发送时间: 2015年10月20日 3:50
收件人: Robert Raszuk
抄送: Youjianjie; idr wg
主题: Re: [Idr] New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

If the purpose is to communicate timing properties attached a NLRI, then why limit it to ‘just’ flow spec AF? it could potentially be used for any type NLRI.

To understand the potential, could you share the list of those proposals that were not rolled out due to a micro-second BGP signalled timing requirements?

I am trying to understand if for those BGP signalling would make sense or if there would be better options.

G/



On 19 Oct 2015, at 10:43, Robert Raszuk <[e-mail]<mailto:[e-mail]>> wrote:

Hi Gunter,

You are right if we would limit flowspec to only DDoS mitigation tool.

Apparently number of other use cases popped up since flowspec was first defined.

So while as Thomas already mentioned we could/should discuss choice of encoding I am quite sympathetic to the idea proposed by Jianjie.

Along the same lines today in general we have dropped number of proposals which if not rolled out in the same time would create loops. Perhaps there is light in the end of the tunnel to be also able to activate specific control plane or forwarding behavior at specific time set or for specific time set.

Best,
r.


On Mon, Oct 19, 2015 at 9:31 AM, Gunter Van De Velde <[e-mail]<mailto:[e-mail]>> wrote:
Hi Youjianjie,

I would expect a flow spec rule to be valid for consumption from the moment its originated from a flow spec controller until it is withdrawn by the controller. In the text proposed you relate to different forwarding delays for a router to receive the flow spec rule and hence justifies a need for new community to specify 'valid-time' for the flow spec route. This seems as a pretty light reason for such a complex proposed logical machine.

Be well,
G/

Sent from iCloud

On Oct 19, 2015, at 04:08 AM, Youjianjie <[e-mail]<mailto:[e-mail]>> wrote:
Dear all,

This document proposes a new BGP path attribute called "Flow Extended Attribute", which carries expected valid period information for a FlowSpec rule.
Could you please review? Your comments are welcome.

Thanks,
Jianjie

-----邮件原件-----
发件人: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]<mailto:[e-mail]>]
发送时间: 2015年10月19日 9:58
收件人: Liangqiandeng; Zhuangshunwan; Youjianjie; Zhuangshunwan; Youjianjie; Liangqiandeng
主题: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt


A new version of I-D, draft-liang-idr-bgp-flowspec-time-00.txt
has been successfully submitted by Jianjie You and posted to the IETF repository.

Name:                draft-liang-idr-bgp-flowspec-time
Revision:    00
Title:                BGP FlowSpec with Time Constraints
Document date:        2015-10-18
Group:                Individual Submission
Pages:      9
URL: https://www.ietf.org/internet-drafts/draft-liang-idr-bgp-flowspec-time-00.txt
Status: https://datatracker.ietf.org/doc/draft-liang-idr-bgp-flowspec-time/
Htmlized: https://tools.ietf.org/html/draft-liang-idr-bgp-flowspec-time-00


Abstract:
The BGP flow specification (FlowSpec) is an additional tool to
mitigate the effects of Distributed Denial of Service (DDoS) attacks.
Since DDoS attacks are dynamic, filtering of a flow may only be
necessary for some specified time, and be undesirable at other times.
This document proposes a new BGP path attribute called "Flow Extended
Attribute", which carries expected valid period information for a
FlowSpec rule. So network administrators can control certain types
of traffic in a specified period.





Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org/>.

The IETF Secretariat

_______________________________________________
Idr mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/idr

_______________________________________________
Idr mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/idr