Re: [ippm] Deborah Brungard's No Objection on draft-ietf-ippm-6man-pdm-option-09: (with COMMENT)

Deborah,

I have posted a new draft which incorporates responses to comments from Mirja and Warren.

https://datatracker.ietf.org/doc/html/draft-ietf-ippm-6man-pdm-option-10

My responses inline to your comments.

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

--------------------------------------------
On Wed, 4/12/17, Deborah Brungard <db3546@att.com> wrote:

 Subject: [ippm] Deborah Brungard's No Objection on draft-ietf-ippm-6man-pdm-option-09: (with COMMENT)
 To: "The IESG" <iesg@ietf.org>
 Cc: draft-ietf-ippm-6man-pdm-option@ietf.org, "Bill Cerveny" <ietf@wjcerveny.com>, ippm-chairs@ietf.org, acmorton@att.com, ippm@ietf.org
 Date: Wednesday, April 12, 2017, 2:28 PM

 > Deborah Brungard has entered the following ballot position for draft-ietf-ippm-6man-pdm-option-09: No Objection

> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions.

> The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-ippm-6man-pdm-option/

 ----------------------------------------------------------------------
 COMMENT:
 ----------------------------------------------------------------------

> Agree with the many comments by the other ADs. Especially, Mirja's and Ben's comments, the document reads like a white paper vs. an IETF specification.

Please check the changes suggested by Mirja and incorporated in the document.   I have responded to Ben and am waiting for his response.

> The "Consent to be Measured" by a user (section 4.4) seems contra to the use case described in the document (estimate QoS as experienced by an end user device). It should be the network
> provider who should be giving "consent to be measured" and the associated risks. Warren also noted these sentences as inappropriate. The document discusses the security aspects relative to the user but is
> missing discussion with respect to the network provider.

Please check the new wording below in response to Warren's comments.  Please let me know if this addresses your concerns.

New
------

An implementation may want to be sure that PDM is enabled only for certain ip addresses, or only for some ports.  Additionally, the implementation SHOULD require an explicit restart of monitoring after
a certain time period (for example for 1 hour), to make sure that PDM is not accidentally left on after debugging has been done etc. 

Even so, if using PDM, a user "Consent to be Measured" SHOULD be a pre-requisite for using PDM.  Consent is common in enterprises and with some subscription services.  The actual content of "Consent to
be Measured" will differ by site but it SHOULD make clear that the traffic is being measured for quality of service and to assist in diagnostics as well as to make clear that there may be potential
risks of certain vulnerabilities if the traffic is captured during a diagnostic session

 _______________________________________________
 ippm mailing list
 ippm@ietf.org
 https://www.ietf.org/mailman/listinfo/ippm