Re: [Mud] Convening MUD calls, + next steps

["M. Ranganathan" <[e-mail]>]

On Tue, May 14, 2019 at 6:13 PM Michael Richardson <[e-mail]>
wrote:

>
> Eliot Lear <[e-mail]> wrote:
>     mr> MUD is a series of "ACCEPT" rules followed by an implicit DROP
> rule. So
>     mr> how can we know that a specific MUD rule caused a packet to be
> dropped?
>     mr> All we know when the packet is dropped (or marked for drop) is
> that NO
>     mr> mud rule allowed the packet to proceed.
>
>     > On the whole this is generally true. The fact that the packet was
> dropped
>     > means that NONE of the accept rules were met, and that’s a lot of
> information
>     > right there. ie, my-controller, same-manufacturer etc didn’t match,
> or they
>     > matched a reject rule. Do others have thoughts there?
>
> But the rules aren't actually fully specific.
> They get instantiated:
>   1) source is the device (by... L2? L3? depends upon implementation)
>   2) destination is an IP, but rule is by name, so how did DNS resolve?
>
> It would be ideal if one could identify packets that would have matched if
> only the source was different, or the destination was resolved differently.
> This requires a bit of fuzzy matching against the drop-log.
>
> That probably accounts for 9 out 10 situations where packets were dropped
> that were not really malicious.
>

If we put a Source MAC/IP classification to activate a notification action
in place of the implied drop, we could notify on the basis of
those classifications.

The implementation mechanism that is used to classify packets is not so
relevant IMHO.

What is important is that the packets, get classified and then get dropped
because they
misbehave. The MUD rules are stated on the basis of these classifications.

So while you cannot state that a specific MUD rule caused a drop, you CAN
state that a particular classification of packets caused a drop.

Why not use the same classification mechanism that MUD uses to notify that
a packet originated by the
MUD-enabled device did something that the MUD rules disallowed?

This would allow the administrator to select the notifications that he
wants to provide to the manufacturer.




>
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
>

-- 
M. Ranganathan