Re: [secdir] Secdir review of draft-ietf-opsawg-large-flow-load-balancing-11

[Anoop Ghanwani <[e-mail]>]

On Thu, May 1, 2014 at 9:25 PM, Chris Inacio <[e-mail]> wrote:

>
>
> After reading Yoav's review, I was curious about this document.
>
> I would agree, roughly, with Yoav's comments on flow description.  The
> table at the beginning of the document (section 2) I feel would be much
> better served with its Y axis labeled as bandwidth, and not flow scale.
>

We have modified the figure to show this as "Bandwidth.

>
> From a technical point of view, the only issue I have with the document is
> that I feel that it misses how long lived flows are identified.  I
> understand the technical challenge that this presents: how should a middle
> box understand/guess the intention of the end points for the duration of a
> flow?  There are likely to be some heuristics that could be
> developed/included that would be likely to have some indication as to the
> lifetime.  For example, SSH keep alives with an otherwise minimal (smallest
> of small) flow, or VPN identification.  (Of course with VPN, the flow can
> quickly switch from small to large and back to small.)  Devices with
> enhanced flow inspection can obviously label the traffic via inspection.
>
> I have 2 possible security considerations:
>
> Assuming the multi paths might lead to equal but diverse Internet
> connections (anycast), does moving flows between paths provide an attacker
> who has already penetrated an enterprise, the possibility to further evade
> detection of border monitoring devices via flow flopping?  Possibly evading
> stateful inspection at the border?
>

This would be unlikely since the the packets still follow the same path
that other regular packets follow.  It is just pinned to a specific path
rather than being allow to use whatever the hash algorithm dictates.


>
> And less likely: From a security point of view, sophisticated attackers,
> persistent attackers, like to map their target environment (hosts and
> network) before attempting their actual attack (DoS, exfiltration,
> destruction, etc.).  Does the movement of flows across otherwise redundant
> links expose more network structure, especially with respect to traceroute
> for an attacker.
>

The traceroute itself probably wouldn't be a large flow so that by itself
shouldn't be affected by this scheme.

We have augmented the security section based on comments from the GEN-ART
review.

Anoop