Subject: [Dots] draft-ietf-dots-signal-channel-33

From: "MeiLing Chen" <[email-masked]>
Date: Wed, 15 May 2019 17:08:36 +0800

Hi Tiru, Med;I read draft-ietf-dots-signal-channel-33, I have a question about the parameter of target-protocol,

target-protocol:  A list of protocols involved in an attack.  Values
      are taken from the IANA protocol registry [proto_numbers].
      If 'target-protocol' is not specified, then the request applies to
      any protocol.
question:  how can attack-target detect the protocols involved in an attack?

---

From: "MeiLing Chen" <[email-masked]>
Date: Wed, 15 May 2019 18:17:13 +0800

Hi Tiru, Med;I read draft-ietf-dots-signal-channel-33, I have a question about the parameter of trigger-mitigation,

 trigger-mitigation:   If the parameter value is set to 'false', DDoS
      mitigation will not be triggered for the mitigation request unless
      the DOTS signal channel session is lost.
      If the DOTS client ceases to respond to heartbeat messages, the
      DOTS server can detect that the DOTS signal channel session is
      lost.  More details are discussed in Section 4.7.
Reddy, et al.           Expires November 11, 2019              [Page 18]
Internet-Draft        DOTS Signal Channel Protocol              May 2019
      The default value of the parameter is 'true' (that is, the
      mitigation starts immediately).  If 'trigger-mitigation' is not
      present in a request, this is equivalent to receiving a request
      with 'trigger-mitigation' set to 'true'.
question1: When send mitigation request first time, trigger-mitigation is set true; when session is lost, trigger-mitigation set false will work, so how to know session is lost?
question2: Why need this parameter and What was the initial requirements scenario?

---

From: <[email-masked]>
Date: Wed, 15 May 2019 11:30:06 +0000

Hi Meiling,

Please see inline.

Cheers,
Med

De : MeiLing Chen [mailto:[email-masked]]
Envoyé : mercredi 15 mai 2019 12:17
À : Konda, Tirumaleswar Reddy; BOUCADAIR Mohamed TGI/OLN
Cc : dots
Objet : draft-ietf-dots-signal-channel-33: trigger-mitigation

Hi Tiru, Med;

I read draft-ietf-dots-signal-channel-33, I have a question about the parameter of trigger-mitigation,

      with 'trigger-mitigation' set to 'true'.
question1: When send mitigation request first time, trigger-mitigation is set true; when session is lost, trigger-mitigation set false will work, so how to know session is lost?
[Med] the absence of traffic or replies to server-initiated heartbeats are used to that aim. This covered by this text in the spec:

      If the DOTS server does not receive any traffic from the peer DOTS
      client, then the DOTS server sends heartbeat requests to the DOTS
      client and after maximum 'missing-hb-allowed' threshold is
      reached, the DOTS server concludes the session is disconnected.
      The DOTS server can then trigger pre-configured mitigation
        requests for this DOTS client (if any).

question2: Why need this parameter and What was the initial requirements scenario?
[Med] Please check: https://tools.ietf.org/html/draft-ietf-dots-architecture-13#section-3.3.3

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 15 May 2019 13:00:09 +0000

DDoS Detector by scrubbing the traffic identifies the target and protocols used to attack the victim (e.g. if it is slowloris attack, the protocol number will be TCP (and in future UDP with QUIC)).

Cheers,
-Tiru

From: MeiLing Chen <[email-masked]>
Sent: Wednesday, May 15, 2019 2:39 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; mohamed.boucadair <[email-masked]>
Cc: [email-masked]
Subject: draft-ietf-dots-signal-channel-33

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________

Hi Tiru, Med;

I read draft-ietf-dots-signal-channel-33, I have a question about the parameter of target-protocol,

      any protocol.

---

From: "MeiLing Chen" <[email-masked]>
Date: Thu, 16 May 2019 10:27:46 +0800

Hi Tiru,

DDoS Detector by scrubbing the traffic identifies the target and protocols used to attack the victim (e.g. if it is slowloris attack, the protocol number will be TCP (and in future UDP with QUIC)). 
 [Meiling] "target-protocol" is contained in the mitigation request as an optional parameter, when dots client first send mitigation request to dots server, It just  warning of a suspected attack, the attack have not been scrubbed. what is "DDoS Detector" ? and Is it capable of detect and disposal ddos attack?

 
target-protocol:  A list of protocols involved in an attack.  Values      are taken from the IANA protocol registry [proto_numbers].      If 'target-protocol' is not specified, then the request applies to      any protocol.
question:  how can attack-target detect the protocols involved in an attack?

---

From: "MeiLing Chen" <[email-masked]>
Date: Thu, 16 May 2019 10:35:50 +0800

Hi Med,
It looks like that trigger-mitigation set to false almost never used unless session is lost and then the DOTS client initiate another mitigation request with the trigger-mitigation value of false.

 
 trigger-mitigation:   If the parameter value is set to 'false', DDoS      mitigation will not be triggered for the mitigation request unless      the DOTS signal channel session is lost.      If the DOTS client ceases to respond to heartbeat messages, the      DOTS server can detect that the DOTS signal channel session is      lost.  More details are discussed in Section 4.7.Reddy, et al.           Expires November 11, 2019              [Page 18]Internet-Draft        DOTS Signal Channel Protocol              May 2019      The default value of the parameter is 'true' (that is, the      mitigation starts immediately).  If 'trigger-mitigation' is not      present in a request, this is equivalent to receiving a request      with 'trigger-mitigation' set to 'true'.
question1: When send mitigation request first time, trigger-mitigation is set true; when session is lost, trigger-mitigation set false will work, so how to know session is lost?
[Med] the absence of traffic or replies to server-initiated heartbeats are used to that aim. This covered by this text in the spec:

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 16 May 2019 04:15:11 +0000

Enterprise networks typically have on-premise DDoS mitigation system to scrub traffic (please see the use cases discussed in https://tools.ietf.org/html/draft-ietf-dots-use-cases-17).

Cheers,
-Tiru

From: MeiLing Chen <[email-masked]>
Sent: Thursday, May 16, 2019 7:58 AM
To: Konda, Tirumaleswar Reddy <[email-masked]>; mohamed.boucadair <[email-masked]>
Cc: dots <[email-masked]>
Subject: Re: RE: draft-ietf-dots-signal-channel-33

From: MeiLing Chen <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, May 15, 2019 2:39 PM
To: Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>>; mohamed.boucadair <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: draft-ietf-dots-signal-channel-33

Hi Tiru, Med;

      any protocol.

---

From: "Panwei (William)" <[email-masked]>
Date: Thu, 16 May 2019 07:50:05 +0000

Hi Meiling,

I think this design is used for the case that DOTS server fails to receive a real-time mitigation request from DOTS client during attack time.
The mitigation request with trigger-mitigation set to false is a pre-configured mitigation request, it is sent before a DDoS attack happens. When DOTS server receives such mitigation request, it just saves this request and won’t trigger mitigation immediately.
When the DDoS attack really happens, the DOTS server may receive no messages from DOTS client because the link is congested by attack traffic, then the pre-configured mitigation request will be triggered when DOTS server considers the session is lost. Without this pre-configured mitigation request, the DDoS attack won’t be mitigated at this time.
So I don’t think it is “almost never used”.

Best Regards
Wei Pan

From: Dots [mailto:[email-masked]] On Behalf Of MeiLing Chen
Sent: Thursday, May 16, 2019 10:36 AM
To: mohamed.boucadair <[email-masked]>; Konda, Tirumaleswar Reddy <[email-masked]>
Cc: dots <[email-masked]>
Subject: Re: [Dots] draft-ietf-dots-signal-channel-33: trigger-mitigation

Hi Med,

Hi Tiru, Med;