Re: [OPSEC] Opsdir last call review of draft-ietf-opsec-probe-attribution-05

[Justin Iurman <[e-mail]>]

Hi Linda,

Please see inline ([JI]).

On 6/8/23 18:06, Linda Dunbar via Datatracker wrote:
> Reviewer: Linda Dunbar
> Review result: Not Ready
> 
> I have reviewed this document as part of the Ops area directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the Ops area directors.
> Document editors and WG chairs should treat these comments just like any other
> last-call comments.
> 
> Summary:
> This document describes the method for any organizations to send queries to
> understand the received unsolicited probing packets.

[JI] I think there might be a misunderstanding here. What we define for 
the in-band technique is just a simple way to include a probe 
description URI (a link, an email address, a phone number, etc) in 
probes/packets so that third parties on the path would be able to 
identify them (what's the reason for such probes? who's responsible for 
that? what's the purpose? etc). We do *not* define how third parties 
would verify the probe attribution (at least, we explain how, but we do 
not define a query to do that automatically).

> Issues:
> - Are those queries generated automatically?

[JI] Not really sure about what you mean with "queries". See the above 
explanation. If I missed your point, please shout.

> - If the queries are generated automatically, does it require routers upgrade
> to support the auto-generating of those queries? - If the queries are generated
> manually, the draft should give some detailed examples since those queries will
> be generated by people not coming to IETF. - Today, most routers ignore the
> Internet probes they don't support. What are the problems of ignoring them?

[JI] No, routers do not need any upgrade. If the out-of-band technique, 
nothing is included in probes. If the in-band technique, the probe 
attribution is included in probes, but these bytes are just like data 
payload.

Thanks,
Justin

> Best Regards,
> Linda Dunbar
> 
> 
>