Subject: [OPSAWG] Questions on draft-lear-opsawg-mud-reporter-00

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Fri, 19 Jul 2019 20:29:10 +0000

Hello, authors.  I’ve been reading through the drafts to be presented at IETF 105, and I just got through this draft.

I have some questions on the ietf-mud-reporter model.  Would this model be implemented on the MUD controller?  Would it not make sense for these report nodes to be “config false” as they are mainly used to provide statistics to the collector.

I see you’re using a 32-bit int for the drop-count.  Would it not make sense to make this a 64-bit counter instead?  Yeah, this number should be low, but if something goes crazy, having a larger field space might be useful.

Joe

---

From: Eliot Lear <[email-masked]>
Date: Sat, 20 Jul 2019 06:46:59 -0400

> On 19 Jul 2019, at 16:29, Joe Clarke (jclarke) <[email-masked]> wrote:
> 
> I have some questions on the ietf-mud-reporter model.  Would this model be implemented on the MUD controller?

Yes.

>  Would it not make sense for these report nodes to be “config false” as they are mainly used to provide statistics to the collector.

Not sure what you mean.

> I see you’re using a 32-bit int for the drop-count.  Would it not make sense to make this a 64-bit counter instead?  Yeah, this number should be low, but if something goes crazy, having a larger fi…

It’s a lot of drops.  Let’s talk about scaling this because there are a great many.

Eliot

> 
> Joe
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

---

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Sat, 20 Jul 2019 13:24:41 +0000

> On Jul 20, 2019, at 06:46, Eliot Lear <[email-masked]> wrote:
> 
> 
> 

I meant should these report nodes be read-only.

> It’s a lot of drops.  Let’s talk about scaling this because there are a great many.

It is, yes.  But if you started to see a lot of this, you might be able to identify a compromise.

Joe

---

From: "M. Ranganathan" <[email-masked]>
Date: Sat, 20 Jul 2019 11:01:07 -0400

On Sat, Jul 20, 2019, 9:24 AM Joe Clarke (jclarke) <[email-masked]>
wrote:

> >> I see you’re using a 32-bit int for the drop-count.  Would it not make
> sense to make this a 64-bit counter instead?  Yeah, this number should be
> low, but if something goes crazy, having a larger field space might be
> useful.
> >

A relative drop count is probably sufficient to identify issues. For
example, if the manufacturer is informed that packets to local network are
being dropped (his device wants to send to a locally bound controller) then
it probably means that  the controller has not been bound. Exact drop
counts are probably not required.
I think it would be worthwhile to run through a complete scenario (i.e.
simulated "malfunctioning" device and diagnostic report) to determine what
is actually required to be reported.

Ranga