Subject: [Mud] Using MUD to enforce network traffic policies

From: Luca Deri <[email-masked]>
Date: Tue, 10 Sep 2019 09:08:55 +0200

Hi all,
I am the developer of an open source network traffic monitoring application named ntopng (https://github.com/ntop/ntopng). I have started to use MUD to enhance ntopng to planned for MUD enhancements to make it suitable not jus for IoT devices but also for generic devices as tablets and laptops. In my view MUD is a great starting point to create a “portable” device network behaviour that could be used in cybersecurity and traffic monitoring to spot unexpected traffic flows. I have written a short blog post https://www.ntop.org/ntopng/using-rfc8520-mud-to-enforce-hosts-traffic-policies-in-ntopng/ <https://www.ntop.org/ntopng/using-rfc8520-mud-to-enforce-hosts-traffic-policies-in-ntopng/> that explains this in detail and highlights the ongoing developments.

I would be glad to receive some feedback in particular related to MUD extensions that are IMHO necessary to make it more general than the original idea.

Regards Luca

---

From: "M. Ranganathan" <[email-masked]>
Date: Tue, 10 Sep 2019 10:38:56 -0400

Hello,

interesting development.

On Tue, Sep 10, 2019 at 3:09 AM Luca Deri <[email-masked]> wrote:

> Hi all,
> I am the developer of an open source network traffic monitoring
> application named ntopng (https://github.com/ntop/ntopng). I have started
> to use MUD to enhance ntopng to planned for MUD enhancements to make it
> suitable not jus for IoT devices but also for generic devices as tablets
> and laptops. In my view MUD is a great starting point to create a
> “portable” device network behaviour that could be used in cybersecurity and
> traffic monitoring to spot unexpected traffic flows. I have written a short
> blog post
> https://www.ntop.org/ntopng/using-rfc8520-mud-to-enforce-hosts-traffic-policies-in-ntopng/ that
> explains this in detail and highlights the ongoing developments.
>
> I would be glad to receive some feedback in particular related to MUD
> extensions that are IMHO necessary to make it more general than the
> original idea.
>
>
The following mud-reporter MUD extension could be of interest in your event
reporting mechanism.

https://github.com/iot-onboarding/mud-reporter/tree/master

It would be interesting to get some feedback from you on the applicability
of this extension to your work.

> --
> Mud mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mud
>

-- 
M. Ranganathan

---

From: Luca Deri <[email-masked]>
Date: Wed, 11 Sep 2019 15:49:24 +0200

Hi
Thanks for your feedback. I have looked at your work and I think it fits with what I a trying to do. With some changes it can be used to report about traffic/match etc stats. My main concern are
- as this format is pretty verbose, how can it cope with high or rich measurements (I am focusing on efficiency)?
- there are several other formats to report data. Yours has a simple yet effective structure, but on the other hand I am wondering (from the standardization standpoint) if this could be a problem to promote it to RFC as this might overlap in scope with other monitoring standards/formats. 

Finally I have seen that your text has a few English typos. Can you fix them or do you want me to send you a pull request?

Regards Luca

> On 10 Sep 2019, at 16:38, M. Ranganathan <[email-masked]> wrote:
> 
> Hello,
> 
> interesting development.
> 
>> I am the developer of an open source network traffic monitoring application named ntopng (https://github.com/ntop/ntopng). I have started to use MUD to enhance ntopng to planned for MUD enhancements to make it suitable not jus for IoT devices but also for generic devices as tablets and laptops. In my view MUD is a great starting point to create a “portable” device network behaviour that could be used in cybersecurity and traffic monitoring to spot unexpected traffic flows. I have written a short blog post https://www.ntop.org/ntopng/using-rfc8520-mud-to-enforce-hosts-traffic-policies-in-ntopng/ that explains this in detail and highlights the ongoing developments.
>> 
> The following mud-reporter MUD extension could be of interest in your event reporting mechanism. 
> 
> It would be interesting to get some feedback from you on the applicability of this extension to your work. 
> 
>  
>> Regards Luca
> 
> 
> 
>  
>> -- 
>> Mud mailing list
>> [email-masked]