Subject: Re: [Dots] 答复: DOTS: next steps - call for editor volunteers for use case draft and requirements draft

From: Xiaohong Deng <[email-masked]>
Date: Thu, 27 Aug 2015 04:23:59 +0000

Hi Frank,

More inline please.

>From: "Xialiang (Frank)" <[email-masked]<mailto:[email-masked]>>
>Date: Thursday, 27 August 2015 1:41 pm
>To: x Deng <[email-masked]<mailto:[email-masked]>>
>Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Roman D. Danyliw" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
>Subject: 答复: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

>Hi Xiaohong,
>The DOTS’s signaling works include two parts: the signaling content itself and the protocol used to carry them. For the first part, the DDoS related telemetry should be included. The >associated information model should also be defined in DOTS from my understanding.

Thanks for this information. Good to know other interest parties in the game. I had a quick read of your draft. Definitely interesting. Did you present it in last meeting? What’s the feedback you get so far?

>Actually, we have a draft (draft-fu-ipfix-network-security-01) proposing some new IPFIX IEs (Information Elements) as DDoS related telemetry. Another draft (draft-teague-open-threat->signaling-01) has also proposed some useful telemetry data for representing DDoS incidents information (events, protected objects, attack/threats enumeration, etc) using IPFIX format as well.

Nice to know there are more works related. IPFIX as the format and content of DDoS telemetry: like you said, events, attack/threats enumeration etc are still to be addressed – that’s my perception too.

>Any good ideas are welcome to bring to DOTS.

Thanks. And surely I think openness is always part of the IETF culture, after all making and keeping an open Internet is the ultimate goal of IETF, isn’t it? :)

Kind Regards,
Xiaohong

>B.R.
>Frank

发件人: Dots [mailto:[email-masked]] 代表 Xiaohong Deng
发送时间: 2015年8月27日 10:47
收件人: [email-masked]<mailto:[email-masked]>
抄送: [email-masked]<mailto:[email-masked]>
主题: Re: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

Hello Chairs and WG,

Maybe not directly in relation to this CFV. A question related to the charter:

Since the charter mentioned signalling DDoS related telemetry, is there any WG intention/interest to work on definition and/or problem statement of DDoS related telemetry? Our recent study suggests that even though there are various (SDN) analytic platforms out there in both research community and industry, which are able to infer DDos and other network anomalies, but each use their self-defined telemetry and far from scandalisation. I personally see there is a valid problem and DOTs sounds like an ideal place to address it.

Any thoughts from Chairs and WG? If there is already WG discussion related to this, please fill me in. Much appreciated.

Cheers,

Xiaohong

School of EE & Telecommunications, UNSW

Le 16/08/2015 07:27, Tobias Gondrom a écrit :
Hello dear DOTS colleagues,

during our first meeting we had consensus to consolidate the independent use cases and requirements into one use case draft and one requirements draft.

Roman and I would like to call for volunteers for editing these two drafts.

if you are interested, please send an email to myself and Roman or to the DOTS mailing-list until August 20.

Best regards,
Tobias
(co-chair DOTS)

On 16/08/15 08:31, Roman D. Danyliw wrote:

Hello WG!

The minutes from IETF 93 have been uploaded.  Please see https://www.ietf.org/proceedings/93/minutes/minutes-93-dots.

Regards,

Roman

_______________________________________________

Dots mailing list

[email-masked]<mailto:[email-masked]>https://www.ietf.org/mailman/listinfo/dots

_______________________________________________

Dots mailing list

[email-masked]<mailto:[email-masked]>https://www.ietf.org/mailman/listinfo/dots

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 27 Aug 2015 06:12:42 +0000

Hi Xiaohong,
My response inline:

发件人: Xiaohong Deng [mailto:[email-masked]]
发送时间: 2015年8月27日 12:24
收件人: Xialiang (Frank)
抄送: [email-masked]; Roman D. Danyliw; [email-masked]
主题: Re: 答复: [Dots] DOTS: next steps - call for editor volunteers for use case draft and requirements draft

Hi Frank,

More inline please.

Thanks for this information. Good to know other interest parties in the game. I had a quick read of your draft. Definitely interesting. Did you present it in last meeting? What’s the feedback you get so far?
[Frank]: Yes, we have present it during the previous 2 DOTS sessions. I think it has received some positive feedbacks about its usefulness indeed. Of course, there is not deep discussion about the solution details now because we are at the beginning stage of DOTS. But I believe they are valuable for the DOTS work.

Nice to know there are more works related. IPFIX as the format and content of DDoS telemetry: like you said, events, attack/threats enumeration etc are still to be addressed – that’s my perception too.
[Frank]: network traffic/flow sampling metrics are also very useful for providing the in-depth network visibility that can be used for the DDoS attacks detection, in my opinions.

Kind Regards,
Xiaohong

Hello Chairs and WG,

Cheers,

Xiaohong

Best regards,
Tobias
(co-chair DOTS)

Hello WG!

Regards,

Roman

Dots mailing list

Dots mailing list