Subject: [Dots] I-D Action: draft-ietf-dots-telemetry-06.txt

From: [email-masked]
Date: Tue, 07 Apr 2020 00:53:23 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DDoS Open Threat Signaling WG of the IETF.

        Title           : Distributed Denial-of-Service Open Threat Signaling (DOTS) Telemetry
        Authors         : Mohamed Boucadair
                          Tirumaleswar Reddy
                          Ehud Doron
                          Meiling Chen
	Filename        : draft-ietf-dots-telemetry-06.txt
	Pages           : 93
	Date            : 2020-04-07

Abstract:
   This document aims to enrich DOTS signal channel protocol with
   various telemetry attributes allowing optimal DDoS attack mitigation.
   It specifies the normal traffic baseline and attack traffic telemetry
   attributes a DOTS client can convey to its DOTS server in the
   mitigation request, the mitigation status telemetry attributes a DOTS
   server can communicate to a DOTS client, and the mitigation efficacy
   telemetry attributes a DOTS client can communicate to a DOTS server.
   The telemetry attributes can assist the mitigator to choose the DDoS
   mitigation techniques and perform optimal DDoS attack mitigation.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dots-telemetry/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dots-telemetry-06
https://datatracker.ietf.org/doc/html/draft-ietf-dots-telemetry-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-telemetry-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: <[email-masked]>
Date: Tue, 7 Apr 2020 08:03:41 +0000

Hi all, 

The main changes in this version are as follows:
* add a reminder that cuid/cdid must not appear in the message body
* add a reminder about the use of YANG
* add a clarification about refresh of telemetry configuration
* Restructure the model to fix a problem raised by Jon about access to max/min data when no tsid is in place.
* Define unit-type 
* attack details are not modeled as an array
* add new containers ton convey protocol- and port-specific telemetry data. 
* add a clarification about partial requests
* add a clarification about the usage of per protocol and per-port metrics. 
* telemetry data can now be filtered using Uri-Query options
* add a note about handling baseline to accommodate non-attack overloads
* describe how to delete "tmids'
* update the cbor/mapping tables. 

The point about long responses is still PENDING.  

Please review and share your comments.

Cheers,
Med

> -----Message d'origine-----
> De : I-D-Announce [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : mardi 7 avril 2020 09:53
> À : [email-masked]
> Cc : [email-masked]
> Objet : I-D Action: draft-ietf-dots-telemetry-06.txt
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: "Meiling Chen" <[email-masked]>
Date: Mon, 13 Apr 2020 07:33:02 +0800

Hi all,
I have reviewed this draft,  and I have some questions:
1. section 7 contains pre-or-ongoing mitigation telemetry, why not the telemetry after the end of mitigation.
2.Telemetry put request sent after a mitigation request, is that means telemetry request and mitigation request will not be in one packet?
3."attack-severity" has three options, how to determine which level the attack is?
4.For "top-talkers", is it necessary to specify the quantity?
 
From: [email-masked]
Date: 2020-04-07 16:03
To: [email-masked]
Subject: Re: [Dots] I-D Action: draft-ietf-dots-telemetry-06.txt
Hi all, 

 
 
Cheers,
Med
 
> à : [email-masked]
> Cc : [email-masked]
 
_______________________________________________
Dots mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dots

---

From: H Y <[email-masked]>
Date: Tue, 14 Apr 2020 15:31:36 +0900

Hi Meiling,

> 4.For "top-talkers", is it necessary to specify the quantity?
IMO, the quantity helps Orchestrator to decide which (src_ip, dst_ip)
flow should be redirected to available DMSs in my use case.

https://datatracker.ietf.org/meeting/106/materials/slides-106-dots-dots-telemetry-usecase-00.pdf

Thanks,
Yuhei

-- 
----------------------------------
Yuuhei HAYASHI
08065300884
[email-masked]
[email-masked]
----------------------------------

---

From: <[email-masked]>
Date: Tue, 14 Apr 2020 11:49:47 +0000

Hi Meiling,

Thank you for the review.

Please see inline.

Cheers,
Med

De : Meiling Chen [mailto:[email-masked]]
Envoyé : lundi 13 avril 2020 01:33
À : BOUCADAIR Mohamed TGI/OLN; dots
Objet : Re: Re: [Dots] I-D Action: draft-ietf-dots-telemetry-06.txt

Hi all,
I have reviewed this draft,  and I have some questions:
1. section 7 contains pre-or-ongoing mitigation telemetry, why not the telemetry after the end of mitigation.
[Med] This is possible, e.g., with a status update (Section 8.1) with "status": "attack-successfully-mitigated".

2.Telemetry put request sent after a mitigation request, is that means telemetry request and mitigation request will not be in one packet?
[Med] Yes. This is why we discuss how to bind the requests:

   DOTS agents SHOULD bind pre-or-ongoing-mitigation telemetry data with
   mitigation requests relying upon the target clause.  In particular, a
   telemetry PUT request sent after a mitigation request may include a
   reference to that mitigation request ('mid-list') as shown in
   Figure 22.  An example illustrating requests correlation by means of
   'target-prefix' is shown in Figure 23.

3."attack-severity" has three options, how to determine which level the attack is?
[Med] This is implementation-specific.

4.For "top-talkers", is it necessary to specify the quantity?
[Med] Yuhei already clarified this one.

From: [email-masked]<mailto:[email-masked]>
Date: 2020-04-07 16:03
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] I-D Action: draft-ietf-dots-telemetry-06.txt
Hi all,

Cheers,
Med