Re: [ippm] DEX Draft Updated

[Martin Duke <[e-mail]>]

Hi Tal,

Thanks for the changes. Some comments on the diff:

(3.1.2) - "The rate of exported packets SHOULD be limited so that the
number of exported
packets is significantly lower than the number of packets that are exported
by the device."

I think there's a typo here? s/exported/received in the second instance?

- s/SHOULD not/SHOULD NOT

- "Furthermore, IOAM encapsulating
  nodes that push a DEX option into traversing packets MUST avoid
  pushing an IOAM header into IOAM exported packets."

but the DEX format is undefined, so I don't know how they could possibly
meet this requirement in the general case. Instead, perhaps
"Furthermore, IOAM encapsulation nodes that can identify a packet as an
IOAM direct export MUST NOT insert a DEX option in those packets"

On Thu, Jul 1, 2021 at 5:54 AM Tal Mizrahi <[e-mail]>
wrote:

> Hi,
>
> The draft was significantly revised (see links below) following the
> security-related feedback from the last IETF meeting, and based on
> further discussion that were held at the IOAM design team meetings.
>
> Thanks again, Martin and Mirja, for your feedback.
>
> The main changes compared to the previous version:
> - Two sections were added, "DEX Packet Selection", and "Responding to
> the DEX Trigger". These two sections are specifically intended to
> address Martin's feedback regarding amplification attacks.
> - New requirements were added to the security consideration section in
> response to the comments in the last IETF meeting:
>   - Selective DEX at IOAM encapsulating nodes - in response to
> Martin's comments.
>     and
>   - Rate limiting at IOAM transit nodes - in response to Martin's comments.
>
>   - Avoid pushing the DEX option onto exported packets - in response
> to Martin's comments.
>
>   - Only export to trusted nodes - in response to Mirja's comments.
>
> Please let us know if there are further comments, and specifically
> regarding the security aspects of the draft.
>
> Cheers,
> Tal.
>
>
>
> On Thu, Jul 1, 2021 at 3:12 PM <[e-mail]> wrote:
> >
> >
> > A new version of I-D, draft-ietf-ippm-ioam-direct-export-04.txt
> > has been successfully submitted by Tal Mizrahi and posted to the
> > IETF repository.
> >
> > Name:           draft-ietf-ippm-ioam-direct-export
> > Revision:       04
> > Title:          In-situ OAM Direct Exporting
> > Document date:  2021-07-01
> > Group:          ippm
> > Pages:          12
> > URL:
> https://www.ietf.org/archive/id/draft-ietf-ippm-ioam-direct-export-04.txt
> > Status:
> https://datatracker.ietf.org/doc/draft-ietf-ippm-ioam-direct-export/
> > Htmlized:
> https://datatracker.ietf.org/doc/html/draft-ietf-ippm-ioam-direct-export
> > Diff:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-ippm-ioam-direct-export-04
> >
> > Abstract:
> >    In-situ Operations, Administration, and Maintenance (IOAM) is used
> >    for recording and collecting operational and telemetry information.
> >    Specifically, IOAM allows telemetry data to be pushed into data
> >    packets while they traverse the network.  This document introduces a
> >    new IOAM option type called the Direct Export (DEX) option, which is
> >    used as a trigger for IOAM data to be directly exported or locally
> >    aggregated without being pushed into in-flight data packets.  The
> >    exporting method and format are outside the scope of this document.
> >
> >
> >
> >
> > The IETF Secretariat
> >
> >
>