Subject: [Dots] IETF 93 minutes

From: "Roman D. Danyliw" <[email-masked]>
Date: Sun, 16 Aug 2015 00:31:53 +0000

Hello WG!

The minutes from IETF 93 have been uploaded.  Please see https://www.ietf.org/proceedings/93/minutes/minutes-93-dots.

Regards,
Roman

---

From: Tobias Gondrom <[email-masked]>
Date: Sun, 16 Aug 2015 13:27:58 +0800

Hello dear DOTS colleagues,

during our first meeting we had consensus to consolidate the independent 
use cases and requirements into one use case draft and one requirements 
draft.

Roman and I would like to call for volunteers for editing these two drafts.

if you are interested, please send an email to myself and Roman or to 
the DOTS mailing-list until August 20.

Best regards,
Tobias
(co-chair DOTS)

On 16/08/15 08:31, Roman D. Danyliw wrote:
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: "Teague, Nik" <[email-masked]>
Date: Sun, 16 Aug 2015 09:36:28 +0000

Hi,

I think Roland was starting on use cases.

I also think Andrews requirements was a good starting point.

I'm happy to edit/co-edit/contribute in whatever way.

Thanks,

-Nik

Sent from my iPhone

On 16 Aug 2015, at 06:28, Tobias Gondrom <[email-masked]<mailto:[email-masked]>> wrote:

during our first meeting we had consensus to consolidate the independent use cases and requirements into one use case draft and one requirements draft.

if you are interested, please send an email to myself and Roman or to the DOTS mailing-list until August 20.

Best regards,
Tobias
(co-chair DOTS)

Hello WG!

Regards,
Roman

_______________________________________________
Dots mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dots

_______________________________________________
Dots mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dots

---

From: "Mortensen, Andrew" <[email-masked]>
Date: Sun, 16 Aug 2015 05:50:47 -0400

> I also think Andrews requirements was a good starting point.

Thanks, Nik. I'm still looking for feedback as I prepare the next revision.

In addition to working on the requirements draft, I also volunteer to
contribute as needed to use case development.

andrew

> On 16 Aug 2015, at 06:28, Tobias Gondrom <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
> Dots mailing [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>https://www.ietf.org/mailman/listinfo/dots
>
>
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>

---

From: "Roland Dobbins" <[email-masked]>
Date: Sun, 16 Aug 2015 17:25:48 +0700

> I think Roland was starting on use cases.

Correct, I'm working on the use cases.

-----------------------------------
Roland Dobbins <[email-masked]>

---

From: Daniel Migault <[email-masked]>
Date: Sun, 16 Aug 2015 14:07:14 -0400

Hi,

I am also happy to get involved in the use cases and requirement documents.
I also think Roland has started to work on it. In addition to Andrews
document, I think that those provided by Chris woudl be useful to start
with.

BR,
Daniel

On Sun, Aug 16, 2015 at 5:36 AM, Teague, Nik <[email-masked]> wrote:

> On 16 Aug 2015, at 06:28, Tobias Gondrom <[email-masked]>
> wrote:
>
> Dots mailing [email-masked]://www.ietf.org/mailman/listinfo/dots
>
>

---

From: "Dacheng Zhang" <[email-masked]>
Date: Mon, 17 Aug 2015 10:34:48 +0800

Hi, Tobias:

This work is valuable and interesting. It would be great if I can join the
editing job of this two drafts.

Cheers

Dacheng

发件人:  Dots <[email-masked]> on behalf of Tobias Gondrom
<[email-masked]>
日期:  2015年8月16日 星期日 下午1:27
至:  <[email-masked]>
主题:  [Dots] DOTS: next steps - call for editor volunteers for use case
draft and requirements draft

 
 
 if you are interested, please send an email to myself and Roman or to the
DOTS mailing-list until August 20.
 
 Best regards, 
 Tobias  
 (co-chair DOTS)

On 16/08/15 08:31, Roman D. Danyliw wrote:

>  
> Hello WG!
> 
> The minutes from IETF 93 have been uploaded.  Please see
> https://www.ietf.org/proceedings/93/minutes/minutes-93-dots.
> 
> Regards,
> Roman
> 
> [email-masked]://www.ietf.org/mailman/listinfo/dots
>  

_______________________________________________ Dots mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/dots

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 17 Aug 2015 09:35:22 +0000

Hi DOTS chairs,
I am interested in these valuable works and be willing to contribute to these 2 drafts.
My personal suggestion: maybe we need some interim meetings for negotiating and synchronizing our works.

B.R.
Frank

发件人: Dots [mailto:[email-masked]] 代表 Tobias Gondrom
发送时间: 2015年8月16日 13:28
收件人: [email-masked]
主题: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft
重要性: 高

Best regards,
Tobias
(co-chair DOTS)

Hello WG!

Regards,

Roman

Dots mailing list

---

From: Stefan Fouant <[email-masked]>
Date: Mon, 17 Aug 2015 15:14:50 +0000

I would also love to be involved in the editing as I have been involved in the DDoS space for some time, both as an operator and also in the vendor space.

Regards,

Stefan Fouant
JNCIE-SEC, JNCIE-SP, JNCIE-ENT, JNCI, CISSP
Senior Security Engineer
Corero Network Security
Mobile: +1.703.625.6243

Your Solution for Real-Time  DDoS Protection<http://www.corero.com/ddos_defense_overview_video>

From: Dots <[email-masked]<mailto:[email-masked]>> on behalf of Tobias Gondrom <[email-masked]<mailto:[email-masked]>>
Date: Sunday, August 16, 2015 at 1:27 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

Best regards,
Tobias
(co-chair DOTS)

Hello WG!

Regards,
Roman

_______________________________________________
Dots mailing list
[email-masked]<mailto:[email-masked]>https://www.ietf.org/mailman/listinfo/dots

---

From: Jérôme François <[email-masked]>
Date: Wed, 26 Aug 2015 13:36:09 +0200

Hi,

Sorry to reply late, I was offline for the last 2 week,s but Abdelkader
and me are willing to contribute to these drafts.

Best regards,
jerome
Inria

Le 16/08/2015 07:27, Tobias Gondrom a écrit :
> during our first meeting we had consensus to consolidate the
> independent use cases and requirements into one use case draft and one
> requirements draft.
>

---

From: Xiaohong Deng <[email-masked]>
Date: Thu, 27 Aug 2015 02:47:24 +0000

Hello Chairs and WG,

Maybe not directly in relation to this CFV. A question related to the charter:

Since the charter mentioned signalling DDoS related telemetry, is there any WG intention/interest to work on definition and/or problem statement of DDoS related telemetry? Our recent study suggests that even though there are various (SDN) analytic platforms out there in both research community and industry, which are able to infer DDos and other network anomalies, but each use their self-defined telemetry and far from scandalisation. I personally see there is a valid problem and DOTs sounds like an ideal place to address it.

Any thoughts from Chairs and WG? If there is already WG discussion related to this, please fill me in. Much appreciated.

Cheers,

Xiaohong

School of EE & Telecommunications, UNSW

Best regards,
Tobias
(co-chair DOTS)

Hello WG!

Regards,
Roman

---

From: "Roland Dobbins" <[email-masked]>
Date: Thu, 27 Aug 2015 12:54:12 +1000

On 27 Aug 2015, at 12:47, Xiaohong Deng wrote:

> Any thoughts from Chairs and WG? If there is already WG discussion 
> related to this, please fill me in. Much appreciated.

I'm not a chair, but this is beyond the remit of this group, IMHO.

Check out IPFIX.

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 27 Aug 2015 03:41:35 +0000

Hi Xiaohong,
The DOTS’s signaling works include two parts: the signaling content itself and the protocol used to carry them. For the first part, the DDoS related telemetry should be included. The associated information model should also be defined in DOTS from my understanding.
Actually, we have a draft (draft-fu-ipfix-network-security-01) proposing some new IPFIX IEs (Information Elements) as DDoS related telemetry. Another draft (draft-teague-open-threat-signaling-01) has also proposed some useful telemetry data for representing DDoS incidents information (events, protected objects, attack/threats enumeration, etc) using IPFIX format as well.

Any good ideas are welcome to bring to DOTS.

B.R.
Frank

发件人: Dots [mailto:[email-masked]] 代表 Xiaohong Deng
发送时间: 2015年8月27日 10:47
收件人: [email-masked]
抄送: [email-masked]
主题: Re: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

Hello Chairs and WG,

Cheers,

Xiaohong

Best regards,
Tobias
(co-chair DOTS)

Hello WG!

Regards,

Roman

Dots mailing list

Dots mailing list

---

From: "Roland Dobbins" <[email-masked]>
Date: Thu, 27 Aug 2015 13:48:34 +1000

On 27 Aug 2015, at 13:41, Xialiang (Frank) wrote:

> Actually, we have a draft (draft-fu-ipfix-network-security-01) 
> proposing some new IPFIX IEs (Information Elements) as DDoS related 
> telemetry. Another draft (draft-teague-open-threat-signaling-01) has 
> also proposed some useful telemetry data for representing DDoS 
> incidents information (events, protected objects, attack/threats 
> enumeration, etc) using IPFIX format as well.

There is no consensus that this is within the remit of the WG; also, 
insufficient attention has been paid to IPFIX enterprise-specific 
information elements in draft-fu-ipfix-network-security-01.  In any 
case, this is beside the point.

There are very good reasons to oppose scope-creep of this group into the 
arena of general telemetry used for the 
detection/classification/traceback of DDoS attacks, and very good 
reasons to maintain its focus on a signaling methodology for requesting 
DDoS mitigation services, which has the beneficial side-effect of making 
the provisioning of said DDoS mitigation services more automated.

---

From: Xiaohong Deng <[email-masked]>
Date: Thu, 27 Aug 2015 04:06:47 +0000

>I'm not a chair, but this is beyond the remit of this group, IMHO.

Thanks for the thoughts. Could you be more specific why you think so?

>Check out IPFIX.

That I¹m aware of. My understanding is that IPFIX provides a mediation
framework.There is still a big gap between framework and security
telemetry people want.
As a matter of fact, industry such as DeepField is now using DNSFlow, BGP,
iBGP, AAA for telemetry. In research community, PerfSonar - world-widely
deployed across domain measurement tool(300 domians covered) are yielding
promising multiple-domain telemetry. Google has its own ³telemetry² WG
working on Chrome telemetry. But again, there is no common place as far as
I am aware of putting together security/DDos telemetry which are highly
desired by both industry and research community. Please correct me or fill
me in if you have more insights on this.

In my humble understanding, since the fundamental purpose of dots is for
DDoS mitigation, and since DDoS telemetry serves purely for that purpose
and it¹s already written in the charter. What¹s the harm of at least
thinking of Problem statement on that aspect?

My 2 cents.

-Xiaohong

---

From: Xiaohong Deng <[email-masked]>
Date: Thu, 27 Aug 2015 04:34:49 +0000

>There is no consensus that this is within the remit of the WG; also,

No consensus YET. That¹s why we are having this discussion, isn¹t it? :)

>case, this is beside the point.

Insufficient attention at some stage doesn¹t necessarily mean the work
isn¹t desired by community nor not good quality enough.I¹ve seen far more
valuable works unfortunately being delayed to delivery for various reasons
in WGs or during individual submission process. In any case, I don¹t see
this as a valid point to object a work. On contrary, IMHO, more attention
should be paid to those who keep raising their hands saying: there are
issues we need to address before it's too late!

>There are very good reasons to oppose scope-creep of this group into the

Which are?

>the provisioning of said DDoS mitigation services more automated.

While you keep saying so, we are awaiting for your good reasons. All ears.

-Xiaohong

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 27 Aug 2015 07:01:25 +0000

Hi Roland,
I think we have reached a consensus that DOTS needs to specify the data model which includes the DDoS related telemetry information as its part, and it's already written in the charter.
Moreover, draft-fu-ipfix-network-security-01 is trying to propose the new standardized ipfix IEs for network attack detection, rather than the IPFIX enterprise-specific ones. Of course, their feasibility and correctness needs more investigation, for we are at the very beginning of whole work.

Anyway, hope to get more comments from the WG.

B.R.
Frank

-----邮件原件-----
发件人: Dots [mailto:[email-masked]] 代表 Roland Dobbins
发送时间: 2015年8月27日 11:49
收件人: [email-masked]
主题: Re: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

> enumeration, etc) using IPFIX format as well.

There is no consensus that this is within the remit of the WG; also, insufficient attention has been paid to IPFIX enterprise-specific information elements in draft-fu-ipfix-network-security-01.  In any case, this is beside the point.

There are very good reasons to oppose scope-creep of this group into the arena of general telemetry used for the detection/classification/traceback of DDoS attacks, and very good reasons to maintain its focus on a signaling methodology for requesting DDoS mitigation services, which has the beneficial side-effect of making the provisioning of said DDoS mitigation services more automated.

---

From: "Roland Dobbins" <[email-masked]>
Date: Thu, 27 Aug 2015 17:12:23 +1000

On 27 Aug 2015, at 17:01, Xialiang (Frank) wrote:

> which includes the DDoS related telemetry information as its part,

The DDoS telemetry referred to in the WG charter is a starting point for 
DOTS signaling - the telemetry itself is out-of-scope for this WG.  If 
the language needs to be massaged to reflect this, we can do it.

> Moreover, draft-fu-ipfix-network-security-01 is trying to propose the 
> new standardized ipfix IEs for network attack detection, rather than 
> the IPFIX enterprise-specific ones.

This is not the appropriate WG for this topic; besides which, many of 
the proposed alterations are questionable, at best.

---

From: "Dacheng Zhang" <[email-masked]>
Date: Thu, 27 Aug 2015 16:15:15 +0800

>the proposed alterations are questionable, at best.

According to our charter, I think this document could be a good start-up
of the future work in our group.

“The WG will, where appropriate, reuse or extend existing standard
protocols and mechanisms (for example, IPFIX and its associated
templating and extension mechanisms). Any modification of or extension
to existing protocols must be in close coordination with the working
groups responsible for the protocol being modified, and may be done in
this working group after agreement with all the relevant WGs and
responsible Area Directors.”

However, I agree that we may need to adjust some contents and make the
draft fit the scope of the group better.

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 27 Aug 2015 12:13:19 +0000

Hi Roland,
Please see inline:

-----邮件原件-----
发件人: Dots [mailto:[email-masked]] 代表 Roland Dobbins
发送时间: 2015年8月27日 15:12
收件人: [email-masked]
主题: Re: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

> which includes the DDoS related telemetry information as its part,

The DDoS telemetry referred to in the WG charter is a starting point for DOTS signaling - the telemetry itself is out-of-scope for this WG.  If the language needs to be massaged to reflect this, we can do it.
[Frank]: I cannot agree with you at this point. But let's see more comments from others. Anyway, we can keep on discussing this point during the progress of the use cases draft and requirements draft.

> the IPFIX enterprise-specific ones.

This is not the appropriate WG for this topic; besides which, many of the proposed alterations are questionable, at best.
[Frank]: Instead of the subjective statements, I prefer to have more constructive discussion on specific technical points.
-----------------------------------
Roland Dobbins <[email-masked]>

---

From: Flemming Andreasen <[email-masked]>
Date: Thu, 27 Aug 2015 08:33:40 -0400

Same situtation here. I'll be happy to contribute to both the use cases 
and requirements.

Cheers

-- Flemming

On 8/26/15 7:36 AM, Jérôme François wrote:
> Hi,
>
> Sorry to reply late, I was offline for the last 2 week,s but 
> Abdelkader and me are willing to contribute to these drafts.
>
> Best regards,
> jerome
> Inria
>
>> independent use cases and requirements into one use case draft and 
>> one requirements draft.
>>
>>> The minutes from IETF 93 have been uploaded.  Please seehttps://www.ietf.org/proceedings/93/minutes/minutes-93-dots.
>>>
>>> Regards,
>>> Roman
>>>

---

From: Flemming Andreasen <[email-masked]>
Date: Thu, 27 Aug 2015 10:29:11 -0400

On 8/27/15 3:12 AM, Roland Dobbins wrote:
> The DDoS telemetry referred to in the WG charter is a starting point 
> for DOTS signaling - the telemetry itself is out-of-scope for this WG. 
Can you clarify the distinction you are making here ? The charter 
explicitly talks about DDoS related telemetry and based on previous 
discussions, It was my understanding that we wanted to provide 
information about an ongoing attack to an upstream entity to enable a 
more accurate and rapid response by that upstream entity.

> If the language needs to be massaged to reflect this, we can do it.
>
I don't think we can just change the charter, however we should make 
sure to capture the outcome of this thread as part of the overall 
requirements.

Thanks

-- Flemming

---

From: "Dacheng Zhang" <[email-masked]>
Date: Mon, 31 Aug 2015 17:33:57 +0800

So, what should we do next? Founding design team and organizing weekly
calls?

Dacheng

发件人:  Dots <[email-masked]> on behalf of Flemming Andreasen
<[email-masked]>
日期:  2015年8月27日 星期四 下午8:33
至:  Jérôme François <[email-masked]>, <[email-masked]>
抄送:  LAHMADI Abdelkader <[email-masked]>
主题:  Re: [Dots] DOTS: next steps - call for editor volunteers for use case
draft and requirements draft

 Same situtation here. I'll be happy to contribute to both the use cases and
requirements. 
 
 Cheers
 
 -- Flemming 

On 8/26/15 7:36 AM, Jérôme François wrote:

>   Hi,
>  
>  Sorry to reply late, I was offline for the last 2 week,s but Abdelkader and
> me are willing to contribute to these drafts.
>  
>  Best regards,
>  jerome 
>  Inria
>  
>  
>>  during our first meeting we had consensus to consolidate the independent use
>> cases and requirements into one use case draft and one requirements draft.
>>

---

From: Jelena Mirkovic <[email-masked]>
Date: Mon, 31 Aug 2015 11:05:02 -0700

I'd be happy to help in any way needed. I'm a researcher who's worked on
DDoS for the last 15 years. I also work in privacy, which will be a concern
for any reports an organization generates about attacks. I'm glad to see
this effort taking off!

=========================

Jelena Mirkovic
Research Faculty
USC Information Sciences Institute
4676 Admiralty Way, Suite 1001
Marina del Rey, CA 90292
310-448-9170

On Mon, Aug 31, 2015 at 2:33 AM, Dacheng Zhang <[email-masked]>
wrote:

> 发件人: Dots <[email-masked]> on behalf of Flemming Andreasen <
> [email-masked]>

---

From: Tobias Gondrom <[email-masked]>
Date: Tue, 01 Sep 2015 00:32:42 +0200

Dear all,

apologies. Roman and I are currently still going through the (long) list 
of editing volunteers. Which is a great place to be in for our WG. I 
guess, we should be done by tomorrow.

In addition to the editing volunteers, I agree that design teams for the 
two drafts might be useful. Always keep in mind that the editor's duty 
is to capture the input from the WG and write it down. So everyone can 
equally contribute. And a design team to work out the details sounds 
useful.

And please also start thinking about which protocols or protocol 
extensions you might need to fulfil the use cases and requirements as 
you write them up. As that will be the eventual outcome for our WG. The 
moment we get rolling on the use cases and requirements drafts, I would 
actually also like to get started on the protocols or at least some of 
them...

Furthermore, Roman and I have also been thinking about a interim meeting 
by the end of September to accelerate progress further.

Best regards,

Tobias

On 31/08/15 11:33, Dacheng Zhang wrote:
> 发件人: Dots <[email-masked] <mailto:[email-masked]>> on 
> behalf of Flemming Andreasen <[email-masked] 
> <mailto:[email-masked]>>
> 至: Jérôme François <[email-masked] 
> <mailto:[email-masked]>>, <[email-masked] <mailto:[email-masked]>>
> 抄送: LAHMADI Abdelkader <[email-masked] 
> <mailto:[email-masked]>>
> Same situtation here. I'll be happy to contribute to both the use 
> cases and requirements.
>
> Cheers
>
> -- Flemming
>
>>> if you are interested, please send an email to myself and Roman or 
>>> to the DOTS mailing-list until August 20.
>>>
>>> Best regards,
>>> Tobias
>>> (co-chair DOTS)
>>>
>>>
> [email-masked] <mailto:[email-masked]>