Subject: [Dots] 'mid' reference to ease requests correlation (RE: DOTS telemetry questions)

From: <[email-masked]>
Date: Mon, 24 Feb 2020 09:18:16 +0000

Hi all,

No change so far. We need to assess this further.

Cheers,
Med

1)      I am confused by "pre-mitigation" which can be transmitted pre any mitigation taking place, or actually during when mitigation is taking place (or so I think) and would simply be better described as "attack-details" - especially with a statement such as

   DOTS agents MUST bind pre-mitigation telemetry data with mitigation

   requests relying upon the target clause.

[Med] That's an option but the current design allows to have the telemetry in // in order to supply more data ** without impacting the placement of a mitigation request ** hence the need to bind both (if any). If telemetry attributes are defined as mandatory (discussed in another thread), this would mean that the server will reject a mitigation that includes such attributes. With the current design, we have a functionality that can be safely enabled independently of the decision that we will make about whether telemetry attributes are mandatory to be supported or not.

Jon> My primary point here was the use of the term "pre-mitigation" - this telemetry is also needs during a mitigation and the attack keeps on morphing into something else.

Another point we can check to ease correlation between a mitigation request and pre-mitigation telemetry is to signal the "mid" in the telemetry message.

Jon> could be - need to think this through

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 25 Feb 2020 10:07:39 +0000

DOTS can leverage https://tools.ietf.org/html/draft-ietf-core-comi-08#section-6.1 to determine whether the telemetry attributes are supported by the DOTS server or not. This will avoid rejection of mitigation request.

Cheers,
-Tiru

From: [email-masked] <[email-masked]>
Sent: Monday, February 24, 2020 2:48 PM
To: Jon Shallow <[email-masked]>; Konda, Tirumaleswar Reddy <[email-masked]>; kaname nishizuka <[email-masked]>; [email-masked]
Subject: 'mid' reference to ease requests correlation (RE: [Dots] DOTS telemetry questions)

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________
Hi all,

Cheers,
Med

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 26 Feb 2020 13:54:00 +0000

On second thought, the current design looks better (no increase to the size of mitigation request and avoids fragmentation).

Cheers,
-Tiru

From: Konda, Tirumaleswar Reddy
Sent: Tuesday, February 25, 2020 3:38 PM
To: [email-masked]; Jon Shallow <[email-masked]>; kaname nishizuka <[email-masked]>; [email-masked]
Subject: RE: 'mid' reference to ease requests correlation (RE: [Dots] DOTS telemetry questions)

Cheers,
-Tiru

From: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Sent: Monday, February 24, 2020 2:48 PM
To: Jon Shallow <[email-masked]<mailto:[email-masked]>>; Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>>; kaname nishizuka <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: 'mid' reference to ease requests correlation (RE: [Dots] DOTS telemetry questions)

Cheers,
Med

Regards

Jon