Subject: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04

From: "Valery Smyslov" <[email-masked]>
Date: Wed, 9 Feb 2022 14:27:38 +0300

Hi,

this message starts a two-week working group last call for draft-ietf-dots-telemetry-use-cases-04.
The WGLC will end on Thursday, February 24. Please, review the draft and send your comments to the mailing list.

Regards,
Frank & Valery.

---

From: <[email-masked]>
Date: Wed, 9 Feb 2022 13:59:24 +0000

Hi Valery, all, 

I support advancing this document, but I think a revised version is needed.

FWIW, some comments and suggestions can be found at: 
* pdf: https://raw.githubusercontent.com/boucadair/IETF-Drafts-Reviews/master/draft-ietf-dots-telemetry-use-cases-04-rev%20Med.pdf 
* doc: https://github.com/boucadair/IETF-Drafts-Reviews/raw/master/draft-ietf-dots-telemetry-use-cases-04-rev%20Med.doc

Cheers,
Med

> -----Message d'origine-----
> De : Dots <[email-masked]> De la part de Valery Smyslov
> Envoyé : mercredi 9 février 2022 12:28
> À : [email-masked]
> Cc : [email-masked]; [email-masked]
> Objet : [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
> 
> Hi,
> 
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: H Y <[email-masked]>
Date: Wed, 9 Feb 2022 23:34:21 +0900

Hi Med,

Thank you for your comments and suggestions.

I will revise the draft in a few days.

Thanks,
Yuhei

-- 
----------------------------------
Yuuhei HAYASHI
08065300884
[email-masked]
[email-masked]
----------------------------------

---

From: H Y <[email-masked]>
Date: Fri, 11 Feb 2022 13:15:54 +0900

Hi all,

We modified some nits and upload as 05. We will add some description
to clarify our use cases.

Comments are welcome.

Thanks,
Yuhei

---

From: <[email-masked]>
Date: Fri, 11 Feb 2022 06:49:49 +0000

Hi Yuhei, 

One quick comment about: 

==
            "attack-description": "DNS amplification Attack: This attack is a type of reflection attack in which attackers spoofes a target's IP address. The attackers abuses vulnerbilities in DNS servers to turn small queries into larger payloads."
==

and 

==
            "attack-description":"NTP amplification Attack: This attack is a type of reflection attack in which attackers spoofes a target's IP address. The attackers abuses vulnerbilities in NTP servers to turn small queries into larger payloads."
==

Please note that the telemetry spec says the following:

   When conveying attack details in DOTS telemetry messages (Sections
   8.2, 8.3, and 9), DOTS agents MUST NOT include the 'attack-
   description' attribute unless the corresponding attack mapping
   details were not previously shared with the peer DOTS agent.

So, the text should explain why "attack-description" attributes are present in the example. 

You may consider removing them but add some text to recall the attack mapping over the data channel. 

Thank you. 

Cheers,
Med

> De : Dots <[email-masked]> De la part de H Y
> Envoyé : vendredi 11 février 2022 05:16
> À : [email-masked]
> Cc : [email-masked]; Valery Smyslov <[email-masked]>;
> BOUCADAIR Mohamed INNOV/NET <[email-masked]>; draft-ietf-
> [email-masked]
> Objet : Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
> 
> Hi all,
> 
> We modified some nits and upload as 05. We will add some description to
> clarify our use cases.
> 
> Comments are welcome.
> 
> Thanks,
> Yuhei
> 
> > > * pdf:
> > > https://raw.githubusercontent.com/boucadair/IETF-Drafts-Reviews/mast
> > > er/draft-ietf-dots-telemetry-use-cases-04-rev%20Med.pdf
> > > * doc:
> > > https://github.com/boucadair/IETF-Drafts-Reviews/raw/master/draft-ie
> > > tf-dots-telemetry-use-cases-04-rev%20Med.doc
> > >
> > > Cheers,
> > > Med
> > >
> > > > Envoyé : mercredi 9 février 2022 12:28 À : [email-masked] Cc :
> > > > [email-masked]; [email-masked]
> > > > this message starts a two-week working group last call for
> > > > draft-ietf- dots-telemetry-use-cases-04.
> > > > The WGLC will end on Thursday, February 24. Please, review the
> > > > draft and send your comments to the mailing list.
> > > >
> > > > Regards,
> > > > Frank & Valery.
> > > >
> > > ____________________________________________________________________
> > > _____________________________________________________
> > >
> > > Ce message et ses pieces jointes peuvent contenir des informations
> > > confidentielles ou privilegiees et ne doivent donc pas etre
> > > diffuses, exploites ou copies sans autorisation. Si vous avez recu
> > > ce message par erreur, veuillez le signaler a l'expediteur et le
> detruire ainsi que les pieces jointes. Les messages electroniques etant
> susceptibles d'alteration, Orange decline toute responsabilite si ce
> message a ete altere, deforme ou falsifie. Merci.
> > >
> > > This message and its attachments may contain confidential or
> > > privileged information that may be protected by law; they should not
> be distributed, used or copied without authorisation.
> > > If you have received this email in error, please notify the sender
> and delete this message and its attachments.
> > > As emails may be altered, Orange is not liable for messages that
> have been modified, changed or falsified.
> > > Thank you.
> > >
> >
> >
> > --

---

From: H Y <[email-masked]>
Date: Fri, 11 Feb 2022 16:40:07 +0900

Hi Med,

I got it. I misunderstood the way to use "attack-description".

>You may consider removing them but add some text to recall the attack mapping over the data channel.
I will remove the "attack-description".

Thanks,
Yuhei

---

From: H Y <[email-masked]>
Date: Fri, 11 Feb 2022 17:00:56 +0900

Hi Med, All,

I updated the draft and submitted it as 06.

>You may consider removing them but add some text to recall the attack mapping over the data channel.
I removed the "attack-description" in signal channel but add some
mapping in data channel.

Thanks,
Yuhei

---

From: "Meiling Chen" <[email-masked]>
Date: Tue, 15 Feb 2022 15:26:31 +0800

Hi all,
Thank you for Med's comments, I have updated the draft to 07.

Name: draft-ietf-dots-telemetry-use-cases
Revision: 07
Title: Use Cases for DDoS Open Threat Signaling (DOTS) Telemetry
Document date: 2022-02-15
Group: dots
Pages: 27
URL: https://www.ietf.org/archive/id/draft-ietf-dots-telemetry-use-cases-07.txt
Status: https://datatracker.ietf.org/doc/draft-ietf-dots-telemetry-use-cases/
Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-dots-telemetry-use-cases
Diff: https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-telemetry-use-cases-07
 
From: H Y
Date: 2022-02-11 16:00
To: Mohamed Boucadair; [email-masked]
CC: [email-masked]; Valery Smyslov; [email-masked]
Subject: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
Hi Med, All,

 
Thanks,
Yuhei

---

From: <[email-masked]>
Date: Tue, 15 Feb 2022 13:02:19 +0000

Hi Meiling, all,

Thank you for these updates.

It seems that the same “start-time” is used in many example. Please check that to see if more realistic examples (with distinct time starts) can be considered.

The draft has some notes, e.g., “[Note: An example of total ..”. I understand that some examples are under preparation.

The latest version removed some attributes such as “src_ip”, but I still see “dst-ip”. You can clarify the meaning/type of this attribute.

Thank you.

Cheers,
Med

De : Meiling Chen <[email-masked]>
Envoyé : mardi 15 février 2022 08:27
À : H Y <[email-masked]>; BOUCADAIR Mohamed INNOV/NET <[email-masked]>; dots <[email-masked]>
Cc : dots-chairs <[email-masked]>; Valery Smyslov <[email-masked]>; [email-masked]
Objet : Re: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04

Hi all,

From: H Y<mailto:[email-masked]>
Date: 2022-02-11 16:00
To: Mohamed Boucadair<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
CC: [email-masked]<mailto:[email-masked]>; Valery Smyslov<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
Hi Med, All,

Thanks,
Yuhei

2022年2月11日(金) 16:40 H Y <[email-masked]<mailto:[email-masked]>>:
> 2022年2月11日(金) 15:49 <[email-masked]<mailto:[email-masked]>>:
> >
> > Hi Yuhei,
> >
> > One quick comment about:
> >
> > ==
> > > De : Dots <[email-masked]<mailto:[email-masked]>> De la part de H Y
> > > À : [email-masked]<mailto:[email-masked]>
> > > Cc : [email-masked]<mailto:[email-masked]>; Valery Smyslov <[email-masked]<mailto:[email-masked]>>;
> > > BOUCADAIR Mohamed INNOV/NET <[email-masked]<mailto:[email-masked]>>; draft-ietf-
> > > [email-masked]<mailto:[email-masked]>
> > > 2022年2月9日(水) 23:34 H Y <[email-masked]<mailto:[email-masked]>>:
> > > >
> > > > Hi Med,
> > > >
> > > > 2022年2月9日(水) 22:59 <[email-masked]<mailto:[email-masked]>>:
> > > > >
> > > > > Hi Valery, all,
> > > > >
> > > > > > De : Dots <[email-masked]<mailto:[email-masked]>> De la part de Valery Smyslov
> > > > > > Envoyé : mercredi 9 février 2022 12:28 À : [email-masked]<mailto:[email-masked]> Cc :
> > > > > > [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
> > > > > > [email-masked]<mailto:[email-masked]>
> > > > [email-masked]<mailto:[email-masked]>
> > > > [email-masked]<mailto:[email-masked]>
> > > [email-masked]<mailto:[email-masked]>
> > > [email-masked]<mailto:[email-masked]>
> [email-masked]<mailto:[email-masked]>
> [email-masked]<mailto:[email-masked]>

--
----------------------------------
Yuuhei HAYASHI
08065300884
[email-masked]<mailto:[email-masked]>
[email-masked]<mailto:[email-masked]>
----------------------------------

_______________________________________________
Dots mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dots

---

From: "Meiling Chen" <[email-masked]>
Date: Wed, 16 Feb 2022 17:23:56 +0800

Hi Med,
Thank you, the remaining yuuhei will be updated on Friday.

Best,
Meiling
 
From: [email-masked]
Date: 2022-02-15 21:02
To: Meiling Chen; H Y; dots
CC: dots-chairs; Valery Smyslov; [email-masked]
Subject: RE: Re: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
Hi Meiling, all, 

 

Thank you. 
 
Cheers,
Med

Hi all,

From: H Y
Date: 2022-02-11 16:00

 
Thanks,
Yuhei

---

From: H Y <[email-masked]>
Date: Thu, 17 Feb 2022 09:00:45 +0900

Hi Med, Meiling,

>Med
Thank you for reviewing it carefully.

>>It seems that the same “start-time” is used in many example. Please check that to see if more realistic examples (with distinct time starts) can be considered.
OK. I will consider it.

>>The draft has some notes, e.g., “[Note: An example of total ..”. I understand that some examples are under preparation.
I'm preparing it for 08.

>>The latest version removed some attributes such as “src_ip”, but I still see “dst-ip”. You can clarify the meaning/type of this attribute.
OK. I will clarify it.

>Meiling
Thank you for updating the draft.

>>3.1.2. Optimal DMS Selection for Mitigation
>>The selected algorithm can be based on different implementations, for example, the available capacity of the DMSes is required to be greater than the peak value, then calculate the average value and select the DMS whose available capacity is closest to the average traffic flow.
I can't understand how the average value can be calculated based on
"low-percentile-g", "mid-percentile-g", "high-percentile-g", "peak-g"
and "current-g".  In addition, I can't understand why it is effective
to select the DMS whose available capacity is closest to the average
traffic flow.

How about the simple description like below?
-------
For example, the simple algorithm of the selection is to choose a DMS
whose available capacity is greater than the "peak-g".
-------

>>3.1.3. Best-path Selection for Redirection
>> For example, The orchestrator know the bandwidth of each link, under the condition that the link is reachable according to the destination address, then based on the traffic limitation and the total traffic should not  exceed the limit of each link segment.

How about the simple description like below?
-------
For example, the simple algorithm of the selection is to choose a path
whose available capacity is greater than the "peak-g".
-------

>>3.1.4. Short but Extreme Volumetric Attack Mitigation
>>Network management system as DOTs client pass the total pipe capacity to administrative system as DOTs server. Consistent with the draft-ietf-dots-telemetry section 7.2.
Can you write an example of the message body?

Thanks,
Yuhei

2022年2月16日(水) 18:24 Meiling Chen <[email-masked]>:
> > > > > > I support advancing this document, but I think a revised version is
>
> > > > needed.
>
> > > > > >
>

---

From: H Y <[email-masked]>
Date: Fri, 18 Feb 2022 12:51:26 +0900

Hi Med, All

I submitted the latest version 08. I think all Med's comments were addressed.

Comments are welcome.

Thanks,
Yuhei

---

From: <[email-masked]>
Date: Fri, 18 Feb 2022 08:45:17 +0000

Hi Yuhei, all,

Thank you very much for taking care of the comments in a timely manner. 

I think that we are almost there, but I'm afraid that one further revision may be needed. 

For convenience, I added the proposed changes directly to the xml file that can find at: 
* xml: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-ietf-dots-telemetry-use-cases-08-rev%20Med.xml
* txt: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/draft-ietf-dots-telemetry-use-cases-08-rev%20Med.txt

A diff to track the proposed changes can be seen at: https://raw.githubusercontent.com/boucadair/IETF-Drafts-Reviews/master/wdiff%20draft-ietf-dots-telemetry-use-cases-08.txt%20draft-ietf-dots-telemetry-use-cases-08-revMed.txt.pdf

The main proposed changes are as follows:

* Updated the security section as the draft includes aspects that were not covered in the telemetry draft (controllers, orchestrators, etc.)
* Added the folding as per RFC8792

Also, 
(1) Can you please clarify in the text what is meant by "teacher labels". 
(2) Most of the use cases include a statement where DOTS client/server are implemented. However, some of the use cases do not include such statement. I would add a similar text for these use cases for consistency. Also, please check that all instances that implement DOTS elements are cited in the examples.  

Some text (e.g., about IPFIX and BGP flow spec) is repeated several times in the draft. I'm OK with that but expect that some reviewers will ask to factorize that text. 

Thank you.

Cheers,
Med

> De : H Y <[email-masked]>
> Envoyé : vendredi 18 février 2022 04:51
> À : BOUCADAIR Mohamed INNOV/NET <[email-masked]>; dots
> <[email-masked]>
> Cc : dots-chairs <[email-masked]>; Valery Smyslov
> <[email-masked]>; [email-masked];
> Meiling Chen <[email-masked]>
> Objet : Re: RE: [Dots] WGLC for draft-ietf-dots-telemetry-use-cases-04
> 
> Hi Med, All
>

---

From: H Y <[email-masked]>
Date: Tue, 22 Feb 2022 09:02:12 +0900

Hi Med,

Thank you so much!

Please see inline.

> * Added the folding as per RFC8792
[Yuhei] Thank you! We will check the update.

> (1) Can you please clarify in the text what is meant by "teacher labels".
[Yuhei] For consistency with the Terminology section, we will update as below.

 After mitigating a DDoS attack, the flow collector attaches outputs
 of the DMS as labels to the statistics of traffic flow of top-
 talkers.  The outputs, for example, are the "attack-id" telemetry
 attributes.  The flow collector, then, carries out supervised machine
 learning to increase its detection accuracy, setting the statistics
 as an explanatory variable and setting the labels as an objective
 variable.

> (2) Most of the use cases include a statement where DOTS client/server are implemented. However, some of the use cases do not include such statement. I would add a similar text for these use cases…
[Yuhei] Thank you. We will check the update.

[Yuhei]  We will update the draft and submit it in a few days.

Thanks,
Yuhei

---

From: <[email-masked]>
Date: Tue, 22 Feb 2022 06:55:19 +0000

Hi Yuhei, 

The proposed text looks good to me. 

As "DMS" is not defined in RFC8612 and the telemetry draft, I suggest you also make the following change:

OLD
   The readers should be familiar with the terms defined in [RFC8612]
   and [I-D.ietf-dots-telemetry].

NEW:
   The readers should be familiar with the terms defined in [RFC8612],
   [RFC8903], and [I-D.ietf-dots-telemetry].

Thank you. 

Cheers,
Med

> Envoyé : mardi 22 février 2022 01:02
> À : BOUCADAIR Mohamed INNOV/NET <[email-masked]>
> <[email-masked]>; dots <[email-masked]>; Meiling Chen
> <[email-masked]>; draft-ietf-dots-telemetry-use-
> [email-masked]
...
>  After mitigating a DDoS attack, the flow collector attaches outputs  of
> the DMS as labels to the statistics of traffic flow of top-  talkers.
> The outputs, for example, are the "attack-id" telemetry  attributes.
> The flow collector, then, carries out supervised machine  learning to
> increase its detection accuracy, setting the statistics  as an
> explanatory variable and setting the labels as an objective  variable.
>

---

From: H Y <[email-masked]>
Date: Wed, 23 Feb 2022 13:24:11 +0900

Hi Med, All,

I have submitted the latest draft as 09. Comments are welcome.

Thanks,
Yuhei

---

From: <[email-masked]>
Date: Wed, 23 Feb 2022 06:27:26 +0000

Hi Yuhei, all,

Thank you for implementing the changes. I have no further comment on the document. I think it is stable and ready to be sent to the IESG. 

Cheers,
Med

> Envoyé : mercredi 23 février 2022 05:24
> <[email-masked]>; Meiling Chen <[email-masked]>; draft-
> [email-masked]
> > > De : Dots <[email-masked]> De la part de H Y Envoyé : mardi
> > > 22 février 2022 01:02 À : BOUCADAIR Mohamed INNOV/NET
> > > <[email-masked]> Cc : dots-chairs
> > > <[email-masked]>; Valery Smyslov <[email-masked]>; dots
> > > <[email-masked]>; Meiling Chen <[email-masked]>;
> > > draft-ietf-dots-telemetry-use- [email-masked] Objet : Re: [Dots]
> > > WGLC for draft-ietf-dots-telemetry-use-cases-04
> > >
> > ...
> > >
> > > >
> > > > Also,
> talkers.
> > > The flow collector, then, carries out supervised machine  learning
> > > to increase its detection accuracy, setting the statistics  as an
> > ______________________________________________________________________
> > ___________________________________________________
> >
> > confidentielles ou privilegiees et ne doivent donc pas etre diffuses,
> > exploites ou copies sans autorisation. Si vous avez recu ce message
> > par erreur, veuillez le signaler a l'expediteur et le detruire ainsi
> que les pieces jointes. Les messages electroniques etant susceptibles
> d'alteration, Orange decline toute responsabilite si ce message a ete
> altere, deforme ou falsifie. Merci.
> >

---

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 28 Feb 2022 14:00:11 +0300

Hi,

the WGLC is over. Thanks to all, who provided comments (especially to Med).

Regards,
Valery.