Re: [Sdn] new draft on SDN for DDoS mitigation

Eddy, et al,

I think the content provided by this draft will be very useful in preventing junk and malicious traffic taking over precious network resources and providing a more effective way to protect applications from DoS/DDoS attacks.

A few comments to the draft:

-       When applications or end points (Customer sites) detect any kind of attack and need to inform ISPs to block those traffic,  the packets content might be using private addresses, local Tenant Identifiers, etc, while the filters for the ISP ingress may  be using "public addresses".

-       Figure 1: The Filter Management Apps is from customer side. The "filter rules" or the commands to "ISF Sub-Controller" may need more than what OpenFlow (e.g. OF1.5) can provide because those rules/commands might need to specify the environmental conditions that are not in the packets, e.g. Time of the Day, a specific event, customer ID, etc. Maybe some other methods should be explored, such as Open-Config, or OF-config, or others

-       The requests from applications and end points may be from different administrative domains than the ISP, therefore it is necessary to have pre-agreed format to pass "Filter rules". The recent IETF initiative (Interface to Network Security Functions - I2NSF is intended to specify the standardized format for specifying rules to security functions. See the latest charter: https://sites.google.com/site/interface2nsf/home ). I see your draft provide a really good input to I2NSF.

Linda

-----Original Message-----
From: sdn [mailto:sdn-bounces@mail.ietf.org] On Behalf Of Wesley Eddy
Sent: Wednesday, August 12, 2015 8:17 AM
To: sdn@irtf.org
Cc: gclark mti-systems.com; Justin Dailey
Subject: [Sdn] new draft on SDN for DDoS mitigation

Hello, we wanted to make people aware of a new I-D that uses SDN (or more specifically OpenFlow) as a tool to improve DDoS mitigation:

https://datatracker.ietf.org/doc/draft-eddy-sdnrg-customer-filters/

The interesting part of this for SDNRG is probably the sub-controller concept, which is how we allow OpenFlow to be used inter-domain (for customers to control aspects of their ISP's network), and the three- stage organization of flow tables.

The content is fairly specific to DDoS, but could be extended and generalized for other uses.

Much of the other interdomain SDN work has the ISPs setting up virtual networks for each customer, or slice-based constructions, which are not required by this sub-controller approach.  It may be of interest as an alternative construction with its own set of advantages and disadvantages in comparison to other interdomain SDN approaches.

We're eager to hear your comments, criticisms, and questions.

--
Wes Eddy
MTI Systems

_______________________________________________
sdn mailing list
sdn@mail.ietf.org<mailto:sdn@mail.ietf.org>
https://mail.ietf.org/mailman/listinfo/sdn