Subject: [Dots] call-home: Call for other scenarios for filtering near sources

From: <[email-masked]>
Date: Fri, 9 Nov 2018 08:52:05 +0000

Hi all,

Franck and Wei mentioned that the call home feature can be useful in other scenarios such as DCs.

I do fully agree with that comment. Hence this call to share your favorite scenarios for filtering near the sources.

We will be more than delighted to include them in the draft.

Thank you.

Cheers,
Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 9 Nov 2018 11:06:41 +0000

The use case is also applicable to SOHO offices. I don’t get the DC use case, data centers should have a DDoS mitigation system (DMS), what is the scenario where on-premise DMS fails to detect the outgoing DDoS attack but the upstream provider is able to detect the outgoing DDoS attack from the data center ?

-Tiru

From: Dots <[email-masked]> On Behalf Of [email-masked]
Sent: Friday, November 9, 2018 2:22 PM
To: [email-masked]
Subject: [Dots] call-home: Call for other scenarios for filtering near sources

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi all,

Thank you.

Cheers,
Med

---

From: <[email-masked]>
Date: Fri, 9 Nov 2018 12:28:20 +0000

Re-,

The use case is that an attack is launched from within a DC and passed away for whatever reason local to that DC configuration. A DC can rely on an upstream DMS for its egress traffic rather than having one locally. I guess this is a matter of deployment taste.

The presence of a on-premise DMS is not a guarantee that all attacks will be detected and mitigated. Collaborating with an upstream DMS make more of sense to increase the efficiency of the solution.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : vendredi 9 novembre 2018 12:07
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : RE: call-home: Call for other scenarios for filtering near sources

-Tiru

Thank you.

Cheers,
Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 9 Nov 2018 12:35:25 +0000

DC would have an DMS not only for inspecting the outgoing traffic but also for the incoming traffic. What kind of data centers are deployed today without edge security ?
DMS in the DC would have more capability detecting some Layer 7 attacks as it can act as a (D)TLS proxy but the upstream DMS cannot act as a proxy.

-Tiru

From: [email-masked] <[email-masked]>
Sent: Friday, November 9, 2018 5:58 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]
Subject: RE: call-home: Call for other scenarios for filtering near sources

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : vendredi 9 novembre 2018 12:07
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]<mailto:[email-masked]>
Objet : RE: call-home: Call for other scenarios for filtering near sources

-Tiru

From: Dots <[email-masked]<mailto:[email-masked]>> On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Friday, November 9, 2018 2:22 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Dots] call-home: Call for other scenarios for filtering near sources

Thank you.

Cheers,
Med

---

From: <[email-masked]>
Date: Fri, 9 Nov 2018 13:32:40 +0000

Re-,

Please see inline.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : vendredi 9 novembre 2018 13:35
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : RE: call-home: Call for other scenarios for filtering near sources

DC would have an DMS not only for inspecting the outgoing traffic but also for the incoming traffic.
[Med] Evidently if such a DMS is deployed. I was focusing on the outgoing traffic because we are discussing the call home case.

What kind of data centers are deployed today without edge security ?
[Med] That is not the question. The question is whether collaboration between a local DMS and an upstream one is more efficient for detecting and mitigation attacks vs. siloed DMS.

[Med] Agree.

-Tiru

Cheers,
Med

-Tiru

Thank you.

Cheers,
Med

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 9 Nov 2018 13:42:30 +0000

Hi Med,

Please see inline [TR]

From: [email-masked] <[email-masked]>
Sent: Friday, November 9, 2018 7:03 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]
Subject: RE: call-home: Call for other scenarios for filtering near sources

Please see inline.

Cheers,
Med

[TR] Okay

[TR] Sure, we should discuss example attack scenarios where such a collaboration is effective. It will help understand the use case better.

-Tiru

-Tiru

From: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Sent: Friday, November 9, 2018 5:58 PM
To: Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: RE: call-home: Call for other scenarios for filtering near sources

Cheers,
Med

-Tiru

Thank you.

Cheers,
Med