[tsvwg] Re: [EXTERNAL] Re: [gwhiteCL/NQBdraft] Should traffic protection be mandatory to implement? (Issue #48)

["Black, David" <[e-mail]>]

>>> [JL] In any case, the user/device/home cannot exceed the bandwidth they have been provisioned.
>>... would be a fine "abuser can only shoot itself in the foot" conclusion to most of the security concerns because the boundaries prevent damage to others.

> [JL] Would that be best in this draft or a more generalized anti-DoS-resilience sort of draft, since this behavior can occur irrespective of whether NQB is used?
Something would need to be stated in this draft in order to use presence of this class of provisioning and boundary enforcement functionality in support of the "abuser can only shoot itself in the foot" conclusion to most of the security concerns.  OTOH, a complete explanation of the possible forms of this functionality and discussion of access network architecture is likely not necessary.

> On the other hand, it seems obvious that if you have provisioned X bandwidth that it would be impossible to exceed that provisioned bandwidth.
What is not obvious is the limitation of this PHB to equipment that can do that class of bandwidth provisioning and enforcement at user/device/home granularity – that would need to be stated.

Thanks, --David

From: Livingood, Jason <jason_livingood=[e-mail]>
Sent: Wednesday, July 24, 2024 1:40 PM
To: Black, David <[e-mail]>; Black, David <[e-mail]>; Overcash, Michael (CCI-Atlanta) <[e-mail]>; gwhiteCL/NQBdraft <[e-mail]>; gwhiteCL/NQBdraft <[e-mail]>
Cc: tsvwg IETF list <[e-mail]>
Subject: Re: [tsvwg] Re: [EXTERNAL] Re: [gwhiteCL/NQBdraft] Should traffic protection be mandatory to implement? (Issue #48)


[EXTERNAL EMAIL]
>> [JL] First hop access gear would typically still have per user/device/home flow boundaries

>Would it be reasonable to specify those boundaries in a bit more detail and limit usage of this PHB to equipment that enforces such boundaries?

>If that were to be done, then ...

>> [JL] In any case, the user/device/home cannot exceed the bandwidth they have been provisioned.

>... would be a fine "abuser can only shoot itself in the foot" conclusion to most of the security concerns because the boundaries prevent damage to others.

[JL] Would that be best in this draft or a more generalized anti-DoS-resilience sort of draft, since this behavior can occur irrespective of whether NQB is used? It could be a very short BCP, basically saying it is best practice in an access network to enforce per-user/device/home bandwidth limits so that one user cannot exceed their provisioned bandwidth and negatively affect other users. On the other hand, it seems obvious that if you have provisioned X bandwidth that it would be impossible to exceed that provisioned bandwidth.