Subject: [Dots] Hi, authors. 3 comments:

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Tue, 5 Mar 2019 06:26:14 +0000

Hi authors,
I have 3 general comments as below:

1.       Can you clarify the DOTS server administrative domain a little bit? What is the goal we define it?

2.       Will this document open a door to make signal channel to cover the functions of data channel more and more?

3.       I can accept the situation of changing the accept-list to the "deactivate" status, but is it a common use case we need to change a deny-list to the "immediate" status?

Thanks!

B.R.
Frank

---

From: kaname nishizuka <[email-masked]>
Date: Tue, 5 Mar 2019 17:00:44 +0900

Hi Frank,

On 2019/03/05 15:26, Xialiang (Frank, Network Standard & Patent Dept) wrote:
> 1.Can you clarify the DOTS server administrative domain a little bit? What is the goal we define it?
>
We'll clarify it and update the draft.

> 2.Will this document open a door to make signal channel to cover the functions of data channel more and more?
>
> 3.I can accept the situation of changing the accept-list to the “deactivate” status, but is it a common use case we need to change a deny-list to the “immediate” status?
>
Regarding with 2 and 3, I can add one usecase to the draft.
When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks).
Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic.
It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel.
Then, it will send mitigation request to the DOTS server.
This kind of procedure is really used by manual operation. Combination of ACL-based filtering and mitigation appliance is cost effective.
The proposed draft (signal-control-filtering) enable automation of it.

regards,
Kaname

---

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Tue, 5 Mar 2019 08:23:51 +0000

Hi Kaname,
I am looking forward to your update draft (possibly more valid use cases) to clarify them.

Some response are inline:

Thanks!

B.R.
Frank

发件人: kaname nishizuka [mailto:[email-masked]]
发送时间: 2019年3月5日 16:01
收件人: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>; [email-masked]
抄送: [email-masked]
主题: Re: Hi, authors. 3 comments:

Hi Frank,

[Frank]: this is just my personal concern about the cut-off line between the 2 DOTS channels. Maybe it does not matter at all. I want to hear more opinions.

3.       I can accept the situation of changing the accept-list to the “deactivate” status, but is it a common use case we need to change a deny-list to the “immediate” status?
[Frank]: sorry, my question expresses wrongly. It should be “is it a common use case we need to change a deny-list to the “deactivate” status?”. My only concern here is whether your use cases for this extensive mechanism is too limited.
Regarding with 2 and 3, I can add one usecase to the draft.
When a DOTS client noticed that a system in its domain is being attacked, it will try to ask for help to a DOTS server in its transit provider (or somewhere in upstream networks).
Sometimes it is hard to get any information from the DOTS server if the upstream is saturated by attack traffic.
It is good strategy to enable ACL(set by data-channel) immediately first via signal-channel. Especially if it is rate-limit ACL, it will make a room for further communication over signal-channel.
Then, it will send mitigation request to the DOTS server.
[Frank]: this use cases explains my previously wrong question~~, thanks!

regards,
Kaname

Thanks!

B.R.
Frank

---

From: <[email-masked]>
Date: Tue, 5 Mar 2019 10:29:53 +0000

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

De : Dots [mailto:[email-masked]] De la part de kaname nishizuka
Envoyé : mardi 5 mars 2019 09:01
À : Xialiang (Frank, Network Standard & Patent Dept); [email-masked]
Cc : [email-masked]
Objet : Re: [Dots] Hi, authors. 3 comments:

Hi Frank,

[Med] This is what is called "DOTS server domain" in DOTS drafts. The notion of "administrative domain" is already used/discussed in the arch I-D.

[Med] No. We do already have this text:

   A DOTS client MUST NOT use the filtering control over DOTS signal

   channel if no attack (mitigation) is active; such requests MUST be

   discarded by the DOTS server with 4.00 (Bad Request).  By default,

   ACL-related operations are achieved using the DOTS data channel

   [I-D.ietf-dots-data-channel<https://tools.ietf.org/html/draft-nishizuka-dots-signal-control-filtering-04#ref-I-D.ietf-dots-data-channel>] when no attack is ongoing.

The draft focuses only on tweaking the status of **existing** filters.

regards,
Kaname

Thanks!

B.R.
Frank

---

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Tue, 5 Mar 2019 10:38:32 +0000

Hi Med,
Thanks for the clarification, we are on the same page now.

B.R.
Frank

发件人: [email-masked] [mailto:[email-masked]]
发送时间: 2019年3月5日 18:30
收件人: kaname nishizuka <[email-masked]>; Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>; [email-masked]
抄送: [email-masked]
主题: RE: [Dots] Hi, authors. 3 comments:

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

De : Dots [mailto:[email-masked]] De la part de kaname nishizuka
Envoyé : mardi 5 mars 2019 09:01
À : Xialiang (Frank, Network Standard & Patent Dept); [email-masked]<mailto:[email-masked]>
Cc : [email-masked]<mailto:[email-masked]>
Objet : Re: [Dots] Hi, authors. 3 comments:

Hi Frank,

[Med] This is what is called “DOTS server domain” in DOTS drafts. The notion of “administrative domain” is already used/discussed in the arch I-D.

regards,
Kaname

Thanks!

B.R.
Frank

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 6 Mar 2019 06:47:16 +0000

Hi Kaname,

Please see inline

[TR] Agreed, but once the DDoS Mitigator starts scrubbing incoming traffic, attack traffic will be dropped and mitigation updates from the DOTS server will reach the DOTS client.

[TR] If all of the incoming traffic is rate-limited, both good and bad traffic will be dropped and may not be acceptable.

[TR] The mitigation request can also enable the ACL (set by data-channel), I don’t get the reason to send the mitigation request again.

Cheers,
-Tiru

From: Dots <[email-masked]> On Behalf Of Xialiang (Frank, Network Standard & Patent Dept)
Sent: Tuesday, March 5, 2019 4:09 PM
To: [email-masked]; kaname nishizuka <[email-masked]>; [email-masked]
Cc: [email-masked]
Subject: [Dots] 答复: Hi, authors. 3 comments:

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi Med,
Thanks for the clarification, we are on the same page now.

B.R.
Frank

发件人: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
发送时间: 2019年3月5日 18:30
收件人: kaname nishizuka <[email-masked]<mailto:[email-masked]>>; Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
抄送: [email-masked]<mailto:[email-masked]>
主题: RE: [Dots] Hi, authors. 3 comments:

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

Hi Frank,

regards,
Kaname

Thanks!

B.R.
Frank

---

From: <[email-masked]>
Date: Wed, 6 Mar 2019 07:47:15 +0000

Hi Tiru,

Please see inline.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : mercredi 6 mars 2019 07:47
À : Xialiang (Frank, Network Standard & Patent Dept); BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; [email-masked]
Cc : [email-masked]
Objet : RE: [Dots] 答复: Hi, authors. 3 comments:

Hi Kaname,

Please see inline

[Med] Agree.

[TR] If all of the incoming traffic is rate-limited, both good and bad traffic will be dropped and may not be acceptable.
[Med] Only the traffic matching the ACL will be rate-limited. Of course, that acl may be defined to cover all the traffic. This scenario is basically as follows:

·         Detect suspicious traffic in a client domain

·         Send a first mitigation with a wide scope + activate some ACLs. Which acls to activate is deployment-specific.

·         Later, send a second mitigation request with an adjusted scope.

[TR] The mitigation request can also enable the ACL (set by data-channel), I don’t get the reason to send the mitigation request again.
[Med] This is required to adjust the scope. A new request is needed.

Cheers,
-Tiru

B.R.
Frank

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

Hi Frank,

regards,
Kaname

Thanks!

B.R.
Frank

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 6 Mar 2019 09:41:24 +0000

Hi Med,

Please see inline [TR2]

From: [email-masked] <[email-masked]>
Sent: Wednesday, March 6, 2019 1:17 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>; kaname nishizuka <[email-masked]>; [email-masked]
Cc: [email-masked]
Subject: RE: [Dots] 答复: Hi, authors. 3 comments:

Please see inline.

Cheers,
Med

À : Xialiang (Frank, Network Standard & Patent Dept); BOUCADAIR Mohamed TGI/OLN; kaname nishizuka; [email-masked]<mailto:[email-masked]>

Hi Kaname,

Please see inline

[TR2] If the DOTS client knows the target resource, why send the mitigation request for wide scope ?
           If the DOTS client does not know the target resource, how can it adjust the scope in the second mitigation request ?
            I don’t understand how the rate-limit ACL is useful in this case ?

-Tiru

Cheers,
-Tiru

From: Dots <[email-masked]<mailto:[email-masked]>> On Behalf Of Xialiang (Frank, Network Standard & Patent Dept)
Sent: Tuesday, March 5, 2019 4:09 PM
To: [email-masked]<mailto:[email-masked]>; kaname nishizuka <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: [Dots] 答复: Hi, authors. 3 comments:

B.R.
Frank

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

Hi Frank,

regards,
Kaname

Thanks!

B.R.
Frank

---

From: <[email-masked]>
Date: Wed, 6 Mar 2019 10:08:00 +0000

Re-,

Please see inline.

Cheers,
Med

De : Konda, Tirumaleswar Reddy [mailto:[email-masked]]
Envoyé : mercredi 6 mars 2019 10:41
À : BOUCADAIR Mohamed TGI/OLN; Xialiang (Frank, Network Standard & Patent Dept); kaname nishizuka; [email-masked]
Cc : [email-masked]
Objet : RE: [Dots] 答复: Hi, authors. 3 comments:

Hi Med,

Please see inline [TR2]

Please see inline.

Cheers,
Med

Hi Kaname,

Please see inline

•         Detect suspicious traffic in a client domain

•         Send a first mitigation with a wide scope + activate some ACLs. Which acls to activate is deployment-specific.

•         Later, send a second mitigation request with an adjusted scope.

[TR2] If the DOTS client knows the target resource, why send the mitigation request for wide scope ?
[Med] The assumption is it does not know the exact “scope”.
           If the DOTS client does not know the target resource, how can it adjust the scope in the second mitigation request ?
[Med] It will conclude that as the attack is progressing.
            I don’t understand how the rate-limit ACL is useful in this case ?
[Med] We don’t need to focus on the rate-limit. I guess Kaname provided that as an example. The ACL can activate an accept-list or whatever actions is judged adequate by the client. I don’t think that we are introducing here a new use case. All these pieces are already covered/allowed by existing specs.

-Tiru

Cheers,
-Tiru

B.R.
Frank

Hi Frank, Kaname,

Please see inline.

Cheers,
Med

Hi Frank,

regards,
Kaname

Thanks!

B.R.
Frank