Subject: Re: [Dots] source-ip-prefix in signal mitigation request.

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 2 Jan 2018 09:01:05 +0000

Hi Jon,

We had published a draft https://tools.ietf.org/html/draft-doron-dots-telemetry-00 that discusses DOTS telemetry to optimize the DDoS mitigation service, the feedback we received from the WG
was to take it up after the initial DOTS WG milestones are met.

Cheers,
-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Jon Shallow
Sent: Friday, December 29, 2017 9:47 PM
To: [email-masked]
Subject: [Dots] source-ip-prefix in signal mitigation request.

Hi WG,

Currently, the signal spec only allows for target-* definitions with the option for Vendor-Specific CBOR Key values.

We have already seen from ietf-100 interoperability tests that there is potentially already one Vendor-Specific definition of source-ip-prefix.

Does it make sense to have "source-ip-prefix" as a standard, optional parameter?

There will be a limitation of number of source IPs that can be defined due to packet MTU.

The mitigation overlapping rules (e.g. same "target-ip") where the highest "mitigation-id" is the active rule will also constrain the number of source IPs.

It does however give the flexibility of, say, temporarily black-listing certain IPs that an intelligent DOTS client has determined to be the most active in an attack.

Comments?

Regards

Jon