Subject: RE: [Ieprep] Diffserv Code Point for Emergency calls

From: "Reinaldo Penno" <[email-masked]>
Date: Sun, 23 Oct 2005 02:40:03 -0400

Hello James,

I am not going to elaborate again but as I mentioned in the previous
email the DDOS HFC threat already exists today without emergency DSCP.

I can DDOS the local broadband segment with EF packets and prevent
emergency calls.

I would like to understand if there are any new threats that an
emergency DSCP bring to the game that do not exist today with EF DSCP.
And if there are new threats, do they outweigh the benefit of an
emergency DSCP?

On the same topic. Do you believe we should do something (not
necessarily DSCP) to prioritize emergency calls or not? 

Thanks,

Reinaldo

> -----Original Message-----
> From: James M. Polk [mailto:[email-masked]]
> Sent: Saturday, October 22, 2005 8:09 PM
> To: Steve Silverman; Reinaldo Penno
> Cc: [email-masked]; ken carlberg
> Subject: RE: [Ieprep] Diffserv Code Point for Emergency calls
> 
> At 09:11 AM 10/22/2005 -0400, Steve Silverman wrote:
> >If calls to a locally pre-specified emergency number (e.g., 911) are
> >given high priority, it is no great exposure.
> 
> "a locally pre-specified number".. hmmm
> 
> several comments:
> 
> - is a URI a number in this context?
>          as SIP is defining a URI, not a number, for emergency calls
> 
> - How many routers that will have a PHB on this DSCP are between you
and
> the local PSAP?
>          could be 5, could be 10 - that impact is greater than the
local
> Class 5 switch from old telco designs
> 
> - If you DDOS the local broadband segment, you eliminate the
possibility
> of
> anyone on that segment from making a emergency call.
>          single HFC segments can be as far away as 100 miles, is that
> local
> anymore?
[[Reinaldo]] 

> 
> >One would think such calls would have locally routable destinations
> >and couldn't travel very far or be used for DDOS attacks.  (Except
> >against the actual emergency systems. How we protect them is another
> >problem. )
> 
> How do you protect a layer 3 packet that has a layer 3 marking and no
> authorization indication in that packet?
> 
> 
> >In the absence of limited addressing or strong user authentication
(as
> >the DOD uses) giving Joe Hacker the ability to get extra high
priority
> >seems like a bad idea to me.
> >
> >It would be helpful if someone (probably ITU rather than IETF) could
> >standardize on a limited number of local emergency calling numbers.
> 
> see
>
http://www.ietf.org/internet-drafts/draft-ietf-ecrit-requirements-00.txt
> 
> 
> >Steve Silverman
> >
> >
> > > -----Original Message-----
> > > From: [email-masked]
> > > [mailto:[email-masked]]On Behalf
> > > Of Reinaldo Penno
> > > Sent: Saturday, October 22, 2005 8:46 AM
> > > To: James M. Polk
> > > Cc: [email-masked]; ken carlberg
> > > Subject: RE: [Ieprep] Diffserv Code Point for Emergency calls
> > >
> > >
> > > Your point is well taken James.
> > >
> > > I guess the risk is no different from what we face nowadays
> > > with doom
> > > packets marked with EF DSCP. The solution as well is no
> > > different from
> > > what we have today to deal with those packets. Usually
> > > independently of
> > > the DSCP an endpoint might put in a packet, the edge router
perform
> > > classification and if necessary remarks the packet with
> > > whatever DSCP it
> > > should have.
> > >
> > > Therefore, if we just continue with just EF for normal and
emergency
> > > voice calls, the risk is the same, the drawback that I see
> > > is that we
> > > cannot prioritize emergency over normal calls.
> > >
> > > So, in general an edge device that can perform SIP parsing and
mark
> > > emergency calls with the emergency DSCP and others with EF DSCP.
> > > Alternatively, in a decomposed gateway scenario the SIP
> > > Proxy can let
> > > the router know that a certain call is an emergency and
> > > that it should
> > > be marked differently.
> > >
> > > Regards,
> > >
> > > Reinaldo
> > >
> > >
> > > > -----Original Message-----
> > > > From: James M. Polk [mailto:[email-masked]]
> > > > Sent: Friday, October 21, 2005 11:02 PM
> > > > To: Reinaldo Penno
> > > > Cc: ken carlberg; [email-masked]
> > > > Subject: Re: [Ieprep] Diffserv Code Point for Emergency calls
> > > >
> > > > Reinaldo
> > > >
> > > > Adding fuel to a discussion that has churned on many
> > > lists over the
> > > last
> > > > several years, I'd really want to understand the threat anaylsis
> > > observed
> > > > by such a proposal (for a emergency DSCP) to ensure it
> > > could not be
> > > used
> > > > for a fairly trivial to generate DDOS on the network -
> > > even all the
> > > way to
> > > > the PSAP, or just used by neighbors wanting the very best
> > > throughput
> > > for
> > > > their game of Doom.
> > > >
> > > > At 10:57 AM 10/21/2005 -0400, ken carlberg wrote:
> > > > >Hello Reinaldo,
> > > > >
> > > > >>I read
> > > >
> > > >>http://www.ietf.org/internet-drafts/draft-ietf-ieprep-fram
> > > ework-10.txt
> > > > >>and was somewhat puzzled at section 4.1.2. I understand that
the
> > > IETF
> > > > >>wants to be conservative in standardizing new DSCP, but
> > > it seems to
> > > an
> > > > >>emergency call DSCP would be accepted by the community (am I
> > > wrong?).
> > > > >
> > > > >well, from my own take, I would say that the "community" is not
> > > > >against an emergency call DSCP per se, but rather awaits
specific
> > > > >proposals with a cautious mindset.  Recall from that
> > > section 4.1.2
> > > > >that there is a need to define a behavior in addition to
> > > identifying
> > > > >a code point.  So if you want a code point of 1 or more bits
for
> > > > >"emergency", what would be its defined forwarding behavior?
> > > > >
> > > > >one such proposal, primarily aimed at MLPP, is called
Multi-Level
> > > > >Expedited Forwarding (MLEF) and can be found at:
> > > >
> > >
>ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-silverman-
> > > > >tsvwg-mlefphb-03.txt
> > > > >
> > > > >I would also suggest reading a counter proposal that
> > > avoids defining
> > > > >a new DSCP:
> > > >
> > >
>ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-ietf-tsvwg-
> > > > >mlpp-that-works-02.txt
> > > > >you can dig around the TSVWG archives over the past 2
> > > months for some
> > > > >comments on the draft.
> > > > >
> > > > >-ken
> > > > >
> > > > >
> > > > >_______________________________________________
> > > > >Ieprep mailing list
> > > > >[email-masked]
> > > > >https://www1.ietf.org/mailman/listinfo/ieprep
> > > >
> > > >
> > > > cheers,
> > > > James
> > > >
> > > >                                  *******************
> > > >                  Truth is not to be argued... it is to be
> > > presented.
> > >
> > > _______________________________________________
> > > Ieprep mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/ieprep
> > >
> 
> 
> cheers,
> James
> 
>                                  *******************
>                  Truth is not to be argued... it is to be presented.

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: "Reinaldo Penno" <[email-masked]>
Date: Mon, 24 Oct 2005 00:15:20 -0400

Well, given that PSTN is resource contending having a different circuit
is a form of special treatment, isn't it?

The analogous in the IP world (which in bandwidth contending) would be
to have bandwidth reservation for a certain number of emergency calls?
Is that the direction the several WGs are leaning towards?

Regards,

Reinaldo

> Sent: Sunday, October 23, 2005 8:43 PM
> To: Reinaldo Penno
> Actually, the PSTN does not give better priority to 911 calls (vs.
normal
> calls), they just use separate cirucuits once the 911 call gets to the
> first Class-5 switch.  Typically, a Class-5 Switch will have a small
> number
> of dedicated circuits that connect directly to a 911 Selective Router
> (which is a special instance of a Class-5 switch). 911 calls are
routed
> over these dedicated circuits towards the SR to then be routed to the
> appropriate PSAP. This isn't really anything special - since the
circuit
> world is not bandwidth contending, they are circuit contending.
> 
> At 10:55 PM 10/23/2005 -0400, Reinaldo Penno wrote:
> 
> 
> > > Sent: Sunday, October 23, 2005 12:50 PM
> > > To: Reinaldo Penno
> > > Comments in-line
> > > At 02:29 AM 10/23/2005 -0400, Reinaldo Penno wrote:
> > > >That is also possible and it might happen all the time.
> > > >
> > > >I think the threats you mention are quite valid but they will be
no
> > > >different if we have an emergency DSCP. The whole problem around
> > > >contention of resources will continue to happen.
> > > >
> > > >My point is the same as before. How this hypothetical scenario is
any
> > > >different from what could happen today?
> > >
> > > Because, as I see it - and please correct me if I am seeing this
> > > incorrectly - that doctor's call in the enterprise will not be
starved
> >off
> > > by any other call.
> > >
> > > Yet, the way I have understood most, and I think the scenario you
have
> > > brought up, the emergency calls will starve off, or at least
adversely
> > > affect existing calls that can be the equivalent of EF marked in
> > > treatment.
> >
> >[[Reinaldo]]
> >
> >But...the doctor call can will fight for resources in the same level
as
> >an emergency call. I guess we should introduce the concept of
"personal
> >emergency" and "collective emergency". If the building is burning up,
I
> >try to call the fire department, and the person in the next cubicle
> >tries to call his priest, which call is more important? I guess this
is
> >a complex issue. We will not be able to resolve it here.
> >
> >If the PSTN today gives better priority to 911 calls, we should
strive
> >to do the same for VoIP calls.
> >
> >Regards,
> >
> >Reinaldo
> >
> > >
> > > Plus there is the issue that most employees operate under a subtly
> > > different set of laws and rules than the general public, usually
> >starting
> > > with when an employee candidate signs a contract of employment
> >reducing
> > > that person's rights in some ways.
> > >
> > >
> > > >For example, today if something happens in an enterprise, will
the
> > > >emergency calls to 911 have better treatment than the doctor's
call?
> >You
> > > >can also imagine a reversed scenario where I could argue that if
the
> > > >call made by the person in the next cubicle to his doctor blocks
my
> >call
> > > >to 911 I will sue the company/telco.
> > > >
> > > >Any hospital in the US has the following recording "if this is an
> > > >emergency, hang up and dial 911". If you really have an
emergency,
> >you
> > > >should be calling 911, and not your doctor.
> > >
> > > While in general, I would agree with you, there are some cases in
> >which a
> > > doctor is who is to be called when you have an issue with
something
> >under
> > > their care.  I have experienced this first hand to know it is true
in
> >the
> > > US.
> > >
> > > >If you call your doctor, you
> > > >are implicitly telling the "system" that this is not an
emergency.
> > >
> > > That's the legacy system you are telling.  Whereas, with IP, we
have
> >many
> > > more capabilities (or should) to be able to differentiate one call
> >from
> > > another. I believe that should one of the IETF's (and other SDO's)
> >goals
> > > for emergency calling.
> > >
> > > Please review ECRIT WG discussions as there are many references to
> >this
> > > capability being on the to-do list of many areas dealing with this
> > > scenario.
> > >
> > >
> > > >Somebody in a Telco told me that 911 calls are signaled different
> >(which
> > > >imply a priority over normal calls). Do you know if this a fact?
> > >
> > > Yes, there are special facilities that 911 calls traverse, after
the
> > > initial Class 5 switch towards the Selective Router, and on to the
> >PSAP.
> > >
> > >
> > > >Regards,
> > > >
> > > >Reinaldo
> > > >
> > > >
> > > >
> > > > > Sent: Saturday, October 22, 2005 8:23 PM
> > > > > To: Reinaldo Penno
> > > > > At 08:45 AM 10/22/2005 -0400, Reinaldo Penno wrote:
> > > > > >voice calls, the risk is the same, the drawback that I see is
> >that we
> > > > > so here's the problem as has been presented to me by both
> >regulators
> > > >and
> > > > > lawyers:
> > > > >
> > > > > In larger emergencies, many people will likely be calling for
> > > >emergency
> > > > > help, and some of them are not going to be calling (the
equivalent
> >of)
> > > > > 911,
> > > > > they will be calling their doctors directly - yet to "the
system",
> > > >these
> > > > > will appear as normal packets, or normal voice (EF marked)
> >packets. In
> > > > > your
> > > > > pondering, these packets will be subject to some form of
lesser
> > > >treatment
> > > > > than perhaps the 10th or 100th call to 911, informing the PSAP
of
> >the
> > > >same
> > > > > event (perhaps a building burning).
> > > > >
> > > > > Here's the catch: who determined the 10th or 100th call to the
> >PSAP is
> > > > > more
> > > > > important than the patient's call with their doctor - getting
> > > >one-on-one
> > > > > advice/help.
> > > > >
> > > > > I think the first lawsuit will stop that preferential
treatment.
> >I've
> > > >had
> > > > > this hinted to me by many
> > > > >
> > > > >
> > > > > >Alternatively, in a decomposed gateway scenario the SIP Proxy
can
> >let
> > > > > >the router know that a certain call is an emergency and that
it
> > > >should
> > > > > >be marked differently.
> > > > >
> > > > > or there could be a path coupled mechanism for such calls, but
> >that
> > > >has
> > > > > its
> > > > > challenges too
> > > > >
> > > > >
> > > > > >Regards,
> > > > > >
> > > > > >Reinaldo
> > > > > >
> > > > > >
> > > > > > > Adding fuel to a discussion that has churned on many lists
> >over
> > > >the
> > > > > >last
could
> >not
> > > >be
even
> >all
>>http://www.ietf.org/internet-drafts/draft-ietf-ieprep-framework-10.txt
it
> >seems
> > > >to
> > > > > > > >well, from my own take, I would say that the "community"
is
> >not
section
> > > >4.1.2
avoids
> > > >defining
months
> > > >some
presented.

---

From: "Dolly, Martin C, ALABS" <[email-masked]>
Date: Mon, 24 Oct 2005 18:24:25 -0500

James,

There are additional Switch call processing requirements.

Cheers,

Martin

> Of Janet P Gunn
> Sent: Monday, October 24, 2005 5:51 AM
> To: James M. Polk
> Cc: [email-masked]; [email-masked]; ken carlberg
> James,
> The PSTN DOES give emergency (911) calls priority in a small way.
> 
> The SS7 signaling messages have an associated priority, 
> called MTP.  When
> an SS7 "server" is congested, it will shed MTP 0 messages 
> before it sheds
> MTP 1 messages.
> 
> Normal call request messages ( ISUP IAMs) are MTP 0.
> Emergency (911), NS/EP. and MLPP call request messages are MTP 1.
> 
> Janet
> 
> [email-masked] wrote on 10/23/2005 11:42:34 PM:
> 
> > Reinaldo
> >
> > Actually, the PSTN does not give better priority to 911 
> calls (vs. normal
> 
> > (which is a special instance of a Class-5 switch). 911 
> calls are routed
> > appropriate PSAP. This isn't really anything special - 
> since the circuit

---

From: "GOLDMAN, STUART O (STUART)" <[email-masked]>
Date: Sat, 29 Oct 2005 20:02:44 -0500

Folks,

What Janet say is of course exactly correct but only when SS7 is in fact used. If the call is routed to the PSAP via MF trunking this indicator is not present. 

James is correct about the typical use of a small number of trunks for the routing which makes sense if you think about the equally small number of call takers at the PSAP. Having significantly more trunks doesn't help with completion if the limiting factor is the human call takers.

So you are all right! 

Stu Goldman
Lucent Technologies
5531 E. Kelton LN
Scottsdale,AZ 85254
602 493 8438 home office
623-582-7136 voicemail  

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Janet P Gunn
Sent: Monday, October 24, 2005 5:51 AM
To: James M. Polk
Cc: [email-masked]; [email-masked]; ken carlberg
Subject: RE: [Ieprep] Diffserv Code Point for Emergency calls

James,

The SS7 signaling messages have an associated priority, called MTP.  When an SS7 "server" is congested, it will shed MTP 0 messages before it sheds MTP 1 messages.

Janet

number
> routed over these dedicated circuits towards the SR to then be routed 
> to the appropriate PSAP. This isn't really anything special - since 
> the circuit world is not bandwidth contending, they are circuit contending.