IETF Logo Mail Archive

Re: [OPSAWG] Questions on draft-lear-opsawg-mud-reporter-00

"M. Ranganathan" <mranga@gmail.com> Sat, 20 July 2019 15:01 UTC

Return-Path: <mranga@gmail.com>
X-Original-To: opsawg@ietfa.amsl.com
Delivered-To: opsawg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 789C812025C for <opsawg@ietfa.amsl.com>; Sat, 20 Jul 2019 08:01:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.997
X-Spam-Level:
X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UmQvLuijlG7F for <opsawg@ietfa.amsl.com>; Sat, 20 Jul 2019 08:01:44 -0700 (PDT)
Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 24DC4120196 for <opsawg@ietf.org>; Sat, 20 Jul 2019 08:01:44 -0700 (PDT)
Received: by mail-io1-xd2e.google.com with SMTP id f4so64621497ioh.6 for <opsawg@ietf.org>; Sat, 20 Jul 2019 08:01:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IZBRL6RJP9CJor3OlB+ni8cI5Q3T09swcwW4+bWPY3I=; b=g0IXa0rytrUGIqe4sTbxMXYgU3C/nsQ02g0uSyXAYCZcculptCQ0UB9eU1M3ahl1JD Or44sJZgpWwu7d/PpbtEJC6NrMMspGQ9jyjYDij8brdp90TWwayFA+ENiJiUdug8qUe0 spBh6n+uXJ5HxOoPgyK86llVJ1tE/jshjJa+5n19o7jV7A3urVgiJXQ7VUrmu/UQZ43/ lVklVj8an63nIbSqfXKfLzrmaxc9d6jzMNPCxw+SaDAt6unzZNpLs21xh7FaKouPZihn JBRC9HQy48FlJv+/wIxcBlBtXQAEpQavOVeXLrltt8Ak0HoYhYcie3oznoxkMXuPq18U CUyg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IZBRL6RJP9CJor3OlB+ni8cI5Q3T09swcwW4+bWPY3I=; b=rCxV9oNaD8LJaRgZHVhqqXW7q57HJZOzbp9jonC7jKeBvULWsgsk+jV0OoXToPq5qy KPLnaqcJ1cYkJ2Na6WAYDRH9UI7k9R2+euXIHcQlDYr6oHaWP04MPk/knV3q7u5OKiHb wLoE7dOMxv0qPGJOrCc9CtLaN0XamHfaF9gyaMMKlROsHcbtcP+rc/OKoGlt32vx4SaW eH55F/mRjVFodFgVv/yf8jjDtZv9b8mkMS47k5eWI1YPMo3Bf1hV1hzzkb5A7mDexnGx 9M0Iy2fGYTomFczNtrVy0LAM2qLwbyy6+Y98ECq+Uqo5mj7812mbkSUkjm42paNfmlid PeBQ==
X-Gm-Message-State: APjAAAUaS+4BUjn9boLN5xKksmodc8ulYgmDYKDTTVS9AGissaUnhwtI yUbT8U+yFQVInazgriw9bXASFkhun1pMBcO29NQ=
X-Google-Smtp-Source: APXvYqwAFnEgTCJB0DAQDeCQz4nMiV8073HVlq1DFTKVOPjhtWOLkcbNpjBWZk2fUVTKLmB2LwKtNlqGeOSEqGKW6rg=
X-Received: by 2002:a6b:7317:: with SMTP id e23mr37080752ioh.37.1563634903195; Sat, 20 Jul 2019 08:01:43 -0700 (PDT)
MIME-Version: 1.0
References: <7CC443D1-5F01-44A4-BA3E-1B2E9E892B80@cisco.com> <253A1C46-3014-41E5-AF4E-BC6383689934@cisco.com> <1C3667D6-23FA-49E8-BEB4-024025846E3F@cisco.com>
In-Reply-To: <1C3667D6-23FA-49E8-BEB4-024025846E3F@cisco.com>
From: "M. Ranganathan" <mranga@gmail.com>
Date: Sat, 20 Jul 2019 11:01:07 -0400
Message-ID: <CAHiu4JOzJ2vfaZ0JZpi4Z_+VuFCReeZAreYzUS4FgWC9uRr8WA@mail.gmail.com>
To: Joe Clarke <jclarke@cisco.com>
Cc: Eliot Lear <lear@cisco.com>, opsawg@ietf.org
Content-Type: multipart/alternative; boundary="000000000000f6a2c8058e1e1e90"
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsawg/qZ0YBKy3x4nm2Kf_7ZKMDnl-QSg>
Subject: Re: [OPSAWG] Questions on draft-lear-opsawg-mud-reporter-00
X-BeenThere: opsawg@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OPSA Working Group Mail List <opsawg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsawg>, <mailto:opsawg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsawg/>
List-Post: <mailto:opsawg@ietf.org>
List-Help: <mailto:opsawg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsawg>, <mailto:opsawg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 20 Jul 2019 15:01:53 -0000

On Sat, Jul 20, 2019, 9:24 AM Joe Clarke (jclarke) <jclarke@cisco.com>
wrote:

>
>
> > On Jul 20, 2019, at 06:46, Eliot Lear <lear@cisco.com> wrote:
> >
> >
>
> >>
> >> I see you’re using a 32-bit int for the drop-count.  Would it not make
> sense to make this a 64-bit counter instead?  Yeah, this number should be
> low, but if something goes crazy, having a larger field space might be
> useful.
> >
> > It’s a lot of drops.  Let’s talk about scaling this because there are a
> great many.
>
> It is, yes.  But if you started to see a lot of this, you might be able to
> identify a compromise.
>

A relative drop count is probably sufficient to identify issues. For
example, if the manufacturer is informed that packets to local network are
being dropped (his device wants to send to a locally bound controller) then
it probably means that  the controller has not been bound. Exact drop
counts are probably not required.
I think it would be worthwhile to run through a complete scenario (i.e.
simulated "malfunctioning" device and diagnostic report) to determine what
is actually required to be reported.

Ranga



> Joe
>
> _______________________________________________
> OPSAWG mailing list
> OPSAWG@ietf.org
> https://www.ietf.org/mailman/listinfo/opsawg
>

v2.23.0 | Report a Bug | By Email