Subject: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

From: "Jon Shallow" <[email-masked]>
Date: Fri, 3 Aug 2018 17:16:53 +0100

Hi there

In Table 2, we have

3. Attack has stopped and the DOTS client can withdraw the mitigation
request. This status code will be transmitted for immediate mitigation
requests till the mitigation is withdrawn or the lifetime expires.  For
mitigation requests with pre-configured scopes (i.e., 'trigger-mitigation'
set to 'false'), this status code will be transmitted 4 times and then
transition to "8".

The "transmitted 4 times" - is this based on the DOTS client doing 4 GET
requests, or 4 observe responses sent (and what is that frequency?), or as
some specific frequency of, say, 30 seconds?

[I have suggested elsewhere in the mailing list that the DOTS server should
be doing observe responses at some frequency, even if the state has not
changed - say every 30 seconds]

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Sat, 4 Aug 2018 04:00:53 +0000

Please see inline

From: Dots <[email-masked]> On Behalf Of Jon Shallow
Sent: Friday, August 3, 2018 9:47 PM
To: [email-masked]
Subject: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi there

In Table 2, we have

3. Attack has stopped and the DOTS client can withdraw the mitigation request. This status code will be transmitted for immediate mitigation requests till the mitigation is withdrawn or the lifetime expires.  For mitigation requests with pre-configured scopes (i.e., 'trigger-mitigation' set to 'false'), this status code will be transmitted 4 times and then transition to "8".

The “transmitted 4 times” – is this based on the DOTS client doing 4 GET requests, or 4 observe responses sent (and what is that frequency?), or as some specific frequency of, say, 30 seconds?

[TR] 4 observe responses are sent (if the DOTS server cannot maintain an RTT estimate, not more than one response every 3 seconds, its discussed in Section 4.4.2). The reason for “transmitted 4 times” is the mitigation request immediately changes state from 3 to 8.

[I have suggested elsewhere in the mailing list that the DOTS server should be doing observe responses at some frequency, even if the state has not changed – say every 30 seconds]

[TR] This point is covered in the draft
<snip>
Due to the higher likelihood of packet loss during a DDoS attack, the DOTS server periodically sends attack mitigation status to the   DOTS client and also notifies the DOTS client whenever the status of the attack mitigation changes.
</snip>

-Tiru

Regards

Jon

---

From: "Jon Shallow" <[email-masked]>
Date: Sat, 4 Aug 2018 12:42:02 +0100

Hi there,

Please see inline Jon>

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 04 August 2018 05:01
To: Jon Shallow; [email-masked]
Subject: Re: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Please see inline 

  _____  

Hi there

In Table 2, we have

[TR] 4 observe responses are sent (if the DOTS server cannot maintain an RTT estimate, not more than one response every 3 seconds, its discussed in Section 4.4.2).

Jon> This then mandates the use of observe – which is my preference as then the DOTS server can at any time
indicate a change of state / conflict etc.  Observe is optional in the draft, including text such as “DOTS client that is no longer interested in receiving notifications from the DOTS server can simply "forget" the observation... This causes the DOTS server to remove the associated entry.”

Jon> Should we mandate observe (for both the mitigate and configuration) for c=n and (possibly implied) c=a?

Jon> An c=c (config only) query with observe should be rejected as it make no real sense (but it could be argued that lifetime is a configuration parameter that is decrementing over time).

[TR] The reason for “transmitted 4 times” is the mitigation request immediately changes state from 3 to 8.  

Jon> I understand why we need to report on this transitive state.

<snip>

</snip>

Jon> This is too loose for me as an implementer to implement and could cause issues working with third-party implementations where different frequency assumptions are made – especially as we are suggesting above that it should be RTT (min 3 secs) for state 3 and pre-configured scopes.  What about the other states?

Jon> For example, I would like to be able to display relatively real-time information about how an attack is getting mitigated from information taken from my DOTS client who is getting the appropriate information from the DOTS server.  Wildly different update frequency assumptions for state 2 make life a bit more complicated.

Jon> I think it would help if we are prescriptive per state in terms of the refresh frequencies (could be added in as another column to Table 2) – a change of state is immediate – something like

State  Frequency(secs)

1            3 – 10

2            30 - 60

3            3 – 10

4            3 – 10

5            3 – 10

6            3 – 10

7            3 – 10

8            120 - 3600

~Jon

-Tiru

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 6 Aug 2018 02:54:23 +0000

Hi Jon,

Please see inline [TR1]

From: Jon Shallow <[email-masked]>
Sent: Saturday, August 4, 2018 5:12 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]
Subject: RE: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Please see inline Jon>

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 04 August 2018 05:01
To: Jon Shallow; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Please see inline

From: Dots <[email-masked]<mailto:[email-masked]>> On Behalf Of Jon Shallow
Sent: Friday, August 3, 2018 9:47 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

In Table 2, we have

[TR1] Good suggestion, we can mandate observe option but not the filtering capability discussed in draft-ietf-core-comi-03 (it’s a non-normative reference).

[TR] Yes.

[TR] This point is covered in the draft
<snip>
Due to the higher likelihood of packet loss during a DDoS attack, the DOTS server periodically sends attack mitigation status to the   DOTS client and also notifies the DOTS client whenever the status of the attack mitigation changes.
</snip>
Jon> This is too loose for me as an implementer to implement and could cause issues working with third-party implementations where different frequency assumptions are made – especially as we are suggesting above that it should be RTT (min 3 secs) for state 3 and pre-configured scopes.  What about the other states ?

[TR1] For every state the frequency assumption is the same following the guidelines given in https://tools.ietf.org/html/rfc8085#section-3.1.3 (I don’t think it’s a good idea to deviate from BCP RFC8085).

-Tiru

1             3 – 10

2             30 - 60

3             3 – 10

4             3 – 10

5             3 – 10

6             3 – 10

7             3 – 10

8             120 – 3600

~Jon

-Tiru

Regards

Jon

---

From: <[email-masked]>
Date: Mon, 6 Aug 2018 06:03:52 +0000

Re-,

I made this change which reflects actually the importance of this option as specified in the draft + RFC7641 is already normative:

OLD:
   The Observe Option defined in [RFC7641] extends the CoAP core
   protocol with a mechanism for a CoAP client to "observe" a resource
   on a CoAP server: The client retrieves a representation of the
   resource and requests this representation be updated by the server as
   long as the client is interested in the resource.

NEW:
   The Observe Option defined in [RFC7641] extends the CoAP core
   protocol with a mechanism for a CoAP client to "observe" a resource
   on a CoAP server: The client retrieves a representation of the
   resource and requests this representation be updated by the server as
   long as the client is interested in the resource.  DOTS
   implementations MUST support the Observe Option for both 'mitigate'
   and 'config' (Section 4.2).

I don’t think we need to over-specify the transmission behavior. We do already provide guidelines to follow.

Please note that RFC7641 is very loose as it only says the following:

“It also MAY choose to send
   more than one notification for the same resource state.”

Cheers,
Med

De : Dots [mailto:[email-masked]] De la part de Konda, Tirumaleswar Reddy
Envoyé : lundi 6 août 2018 04:54
À : Jon Shallow; [email-masked]
Objet : Re: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Hi Jon,

Please see inline [TR1]

Please see inline Jon>

Regards

Jon

Please see inline

In Table 2, we have

[TR] Yes.

-Tiru

1             3 – 10

2             30 - 60

3             3 – 10

4             3 – 10

5             3 – 10

6             3 – 10

7             3 – 10

8             120 – 3600

~Jon

-Tiru

Regards

Jon

---

From: "Jon Shallow" <[email-masked]>
Date: Mon, 6 Aug 2018 09:15:27 +0100

Hi Med/Tiru

Please see inline Jon1> to both Med’s and Tiru’s comments

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of [email-masked]
Sent: 06 August 2018 07:04
To: Konda, Tirumaleswar Reddy; Jon Shallow; [email-masked]
Subject: Re: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Re-,

OLD:

NEW:

Jon1>  I think we should mandate use as well.

implementations MUST use the Observe Option for both 'mitigate'

and 'config' (Section 4.2) for monitoring non-configuration data.

Cheers,

Med

Hi Jon,

Please see inline [TR1]

  _____  

Hi there,

Please see inline Jon>

Regards

Jon

From: Dots [mailto:  <mailto:[email-masked]> [email-masked]] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 04 August 2018 05:01
To: Jon Shallow;  <mailto:[email-masked]> [email-masked]
Subject: Re: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Please see inline 

From: Dots < <mailto:[email-masked]> [email-masked]> On Behalf Of Jon Shallow
Sent: Friday, August 3, 2018 9:47 PM
To:  <mailto:[email-masked]> [email-masked]
Subject: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

  _____  

Hi there

In Table 2, we have

Jon1> Agree about filtering capability – see slight change made to Med’s text update above.

[TR1] Yes. 

Jon1> I think my change to Med’s update text is sufficient to cover this.

<snip>

</snip>

Jon1> I’m happy with every state sending a status every RTT (3 seconds) – but wonder if this is a overkill for state 8.  Hence my suggestion table below.

~Jon1

-Tiru

State  Frequency(secs)

1             3 – 10

2             30 - 60

3             3 – 10

4             3 – 10

5             3 – 10

6             3 – 10

7             3 – 10

8             120 – 3600

~Jon

-Tiru

Regards

Jon

---

From: <[email-masked]>
Date: Mon, 6 Aug 2018 08:37:53 +0000

Re-,

Do we really need to mention “for monitoring non-configuration data”?

What do we lose with the proposed text?

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : lundi 6 août 2018 10:15
À : BOUCADAIR Mohamed IMT/OLN; Konda, Tirumaleswar Reddy; [email-masked]
Objet : RE: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Hi Med/Tiru

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Jon,

Please see inline [TR1]

Please see inline Jon>

Regards

Jon

Please see inline

In Table 2, we have

[TR1] Yes.

-Tiru

1             3 – 10

2             30 - 60

3             3 – 10

4             3 – 10

5             3 – 10

6             3 – 10

7             3 – 10

8             120 – 3600

~Jon

-Tiru

Regards

Jon

---

From: "Jon Shallow" <[email-masked]>
Date: Mon, 6 Aug 2018 09:50:27 +0100

Hi Med,

To me, there is a big different between ‘MUST support’ and ‘MUST use’.  If the DOTS client has ‘support’ for Observe, but does not ‘use’ Observe then the DOTS server cannot send unsolicited messages.

The “for monitoring non-configuration date” was there as doing a Observe request with query c=c does not make any real sense as the configuration will never change.  I am ambivalent about it being in there.

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of [email-masked]
Sent: 06 August 2018 09:38
To: Jon Shallow; Konda, Tirumaleswar Reddy; [email-masked]
Subject: Re: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Re-,

Cheers,

Med

Hi Med/Tiru

Regards

Jon

Re-,

OLD:

NEW:

Cheers,

Med

Hi Jon,

Please see inline [TR1]

  _____  

Hi there,

Please see inline Jon>

Regards

Jon

Please see inline 

  _____  

Hi there

In Table 2, we have

 

[TR1] Yes. 

<snip>

</snip>

~Jon1

-Tiru

State  Frequency(secs)

1             3 – 10

2             30 - 60

3             3 – 10

4             3 – 10

5             3 – 10

6             3 – 10

7             3 – 10

8             120 – 3600

~Jon

-Tiru

Regards

Jon

---

From: <[email-masked]>
Date: Mon, 6 Aug 2018 08:54:57 +0000

Re-,

Fully agree with you about use/support. My comment was about the part I see you are neutral on :-)

NEW:

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : lundi 6 août 2018 10:50
À : BOUCADAIR Mohamed IMT/OLN; Konda, Tirumaleswar Reddy; [email-masked]
Objet : RE: [Dots] WGLC signal draft: What is the transmission frequency for "4 times"

Hi Med,

Regards

Jon

Re-,

Cheers,
Med

Hi Med/Tiru

Regards

Jon

Re-,

OLD:

NEW:

Cheers,
Med

Hi Jon,

Please see inline [TR1]

Please see inline Jon>

Regards

Jon

Please see inline

In Table 2, we have

[TR1] Yes.

-Tiru

1             3 – 10

2             30 - 60

3             3 – 10

4             3 – 10

5             3 – 10

6             3 – 10

7             3 – 10

8             120 – 3600

~Jon

-Tiru

Regards

Jon