Re: [IPsec] Textual changes to the DDoS draft

["Waltermire, David A." <[e-mail]>]

I haven't seen any additional feedback on the DDoS draft this week based on Yoav's note about the PR [1]. It also looks like the discussion on chaining puzzles has wrapped up with no changes needed to the draft [2].

Unless there is any additional concerns with these issues, I believe we are ready for a WGLC on an updated revision of the draft.

Once Yoav posts the updated draft based on the PR, I'll issue the WGLC.

Thanks for working through these last issues.

Thanks,
Dave

[1] https://mailarchive.ietf.org/arch/msg/ipsec/XjuWvb9PvVjH1YMSzAMkAuC1zOQ
[2] https://mailarchive.ietf.org/arch/msg/ipsec/yeS8ooGWfvnxfs8zS24LYYpr9QM

From: IPsec [mailto:[e-mail]] On Behalf Of Yoav Nir
Sent: Monday, February 22, 2016 6:21 AM
To: [e-mail] WG <[e-mail]>
Subject: [IPsec] Textual changes to the DDoS draft

Hi all

Valery submitted a new PR with a couple of textual changes, mostly based on comments by Dave.

https://github.com/ietf-ipsecme/drafts/pull/12

The changes (listed below) seem fine to me. If nobody objects, I will merge them in on Friday.

Yoav

List of changes:

#1: Change snarky reference to Starbucks to something less snarky and less related to starbucks:
OLD:
For example, if a certain purveyor of beverages resembling coffee provides Internet connectivity to its customers through an IPv4 NAT device, a single malicious customer can create enough half-open SAs to fill the quota for the NAT device external IP address. Legitimate Initiators on the same network will not be able to initiate IKE.

NEW:
For example, if an network service provider or some establishment offers Internet connectivity to its customers or employees through an IPv4 NAT device, a single malicious customer can create enough half-open SAs to fill the quota for the NAT device external IP address. Legitimate Initiators on the same network will not be able to initiate IKE.


#2: Purely textual change
OLD:
Regardless of the type of rate-limiting used, there is a huge advantage in blocking the DoS attack using rate-limiting in that legitimate clients who are away from the attacking nodes should not be adversely affected by either the attack or by the measures used to counteract it.

NEW:
Regardless of the type of rate-limiting used, there is a huge advantage in blocking the DoS attack using rate-limiting for legitimate clients that are away from the attacking nodes. In such cases, adverse impacts caused by the attack or by the measures used to counteract the attack can be avoided.