Re: [Mud] Convening MUD calls, + next steps

[Michael Richardson <[e-mail]>]

Eliot Lear <[e-mail]> wrote:
    mr> MUD is a series of "ACCEPT" rules followed by an implicit DROP rule. So
    mr> how can we know that a specific MUD rule caused a packet to be dropped?
    mr> All we know when the packet is dropped (or marked for drop) is that NO
    mr> mud rule allowed the packet to proceed.

    > On the whole this is generally true. The fact that the packet was dropped
    > means that NONE of the accept rules were met, and that’s a lot of information
    > right there. ie, my-controller, same-manufacturer etc didn’t match, or they
    > matched a reject rule. Do others have thoughts there?

But the rules aren't actually fully specific.
They get instantiated:
  1) source is the device (by... L2? L3? depends upon implementation)
  2) destination is an IP, but rule is by name, so how did DNS resolve?

It would be ideal if one could identify packets that would have matched if
only the source was different, or the destination was resolved differently.
This requires a bit of fuzzy matching against the drop-log.

That probably accounts for 9 out 10 situations where packets were dropped
that were not really malicious.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-