Re: [tsvwg] [Dots] Best transport selection during an attack?

[Paul Ferguson <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 11/5/2015 3:27 AM, Roland Dobbins wrote:

>> If the DOTS server is connected to a different provider than
>> DOTS client, then this is a "remote access". Is the provider
>> terminating the DOTS client access part of the DDoS defense
>> system or may this provider be agnostic to all that?
> 
> The main issue is intervening networks.
> 
>> If the latter is true plain provider IP service is my expectation
>> and then QoS transport between client and server is a challenge.
> 
> Yes, that's correct (along with the administrative and 
> internal-political challenges operators may face even when they're 
> directly topologically adjacent to the requesting organization's
> network).

Correct. And that is the big problem with QoS/diffserv packet marking:
Once a packet leaves your network and your administrative control, no
one has to honor your packet markings (QoS). All bets are off.

- - ferg

- -- 
Paul Ferguson
PGP Public Key ID: 0x54DC85B2
Key fingerprint: 19EC 2945 FEE8 D6C8 58A1 CE53 2896 AC75 54DC 85B2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlY7ZtcACgkQKJasdVTchbLdhwD/Rmjk2H1fUperSsoDhk7TkeOS
RINC2V3ooD9+BkLdnoEA/2KirmljqYeyS/Pr+fhVBoPp1ChfT5WcELuIZJENdkzI
=0jkt
-----END PGP SIGNATURE-----