Subject: [Dots] Overlap with DOTS drafts to MILE

From: "Roman D. Danyliw" <[email-masked]>
Date: Tue, 24 Mar 2015 15:48:27 +0000

Hello!

BOF chair hat off ...

Ignoring the necessary discussion on whether XML is appropriate occurring on a separate thread, I conducted a superficial crosswalk of draft-teague-open-threat-signaling-00 and draft-fu-ipfix-network-security against existing MILE drafts to see how the information models line up.  There is some overlap.  These observations are anecdotally enumerated below.  A more detailed analysis would be required if an XML representation or linkages with MILE was deemed appropriate.

Both DOTS drafts have various counters in their IPFIX information models, MILE's IODEF (draft-ietf-mile-rfc5070-bis-11) can represent many of the them.  For example, draft-fu-ipfix-network-security's tcpFinTotalCount field would look as follows in IODEF:

<System>
  <Node>
    <Address enum="ipv4-addr">1.2.3.4</Address>
  </Node>
  <Service ip-protocol="6">
     <ProtoField>1</ProtoField>
  </Service>
  <Counter type="flow" duration="second">29234</Counter>
</System>

However, there are certain counters such as draft-teague-open-threat-signaling's Typical Pps that IODEF does not represent.

draft-teague-open-threat-signaling encodes threat information which IODEF appears could represent in the Method class.

Finally, there are packet specific features of flows (e.g., draft-fu-ipfix-network-security's maximumIpTotalLength) that IODEF doesn't represent.  Likewise, most of the elements of draft-teague-open-threat-signaling's JSON channel don't align with MILE's RID or IODEF.

In most cases where IODEF is lacking, there appears to be a way to create an extension.

Roman