Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m ib-15.txt

From: "Sharon Chisholm" <[email-masked]>
Date: Wed, 8 Oct 2003 15:48:20 -0400

Hi

The following is the proposed resolution to Randy-75-2. Assuming no
objection, this item will is closed with no changes to the draft.

Assuming you referring to the following text:

"  Setting these objects may have disruptive effects on network
   operation that range from omission of alarm notifications to
   flooding of unwanted alarm notifications from the network.
   The consequence of suppressing or deferring the reporting
   of an alarm can prevent the timely delivery of important
   diagnostic information, including information that can help
   identify an attack."

This is not relevant in the case of the Alarm MIB since we neither suppress
or defer notifications. We have text about throttling in the 'normal' places
within the draft.

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Thursday, October 02, 2003 6:56 PM
To: Disman (E-mail)
Subject: [Disman] Security considerations in
draft-ietf-disman-alarm-mib-15.txt

Hi -

WG chair hat on:

> From: "Sharon Chisholm" <[email-masked]>
> To: "Disman (E-mail)" <[email-masked]>
> Cc: <[email-masked]>; "Randy Presuhn" 
> <[email-masked]>; "Romascanu, Dan (Dan)"
<[email-masked]>
> Sent: Monday, September 29, 2003 7:34 AM
> Subject: [Disman] RE: Comments on draft-ietf-disman-alarm-mib-14.txt
...
> 75-2) This section should also mention throttling / DoS attacks based 
> on notification generation.
>
> Sharon->Neither of the examples given in the MIB Review Guidelines do
...

Given the IESG's comments on the ARC MIB, I believe we need to reconsider
this comment.

Randy Presuhn, disman WG chair

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 8 Oct 2003 12:58:00 -0700

Hi -

> Cc: "Randy Presuhn" <[email-masked]>
> Sent: Wednesday, October 08, 2003 12:48 PM
> Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-mib-15.txt
..
> objection, this item will is closed with no changes to the draft.

I object, both as WG chair and as a technical contributor.

> or defer notifications. We have text about throttling in the 'normal' places

Technically:
Even with the throttling language that's there, this MIB can be used
to cause flooding, either due to an exessive number of resources
going into alarm (throttling is in part per resource type),
oscillating (throttling is on consecutive notifications), or distributed
DoS (multiple systems configured).

As Chair:
Given the IESG's comments on the ARC MIB, which show that they are
well aware of these issues, I believe we need to reconsider.

Randy

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 8 Oct 2003 12:58:00 -0700

Hi -

..

Technically:

As Chair:

Randy