Subject: [Dots] 转发: New Version Notification for draft-fu-dots-ipfix-extension-00.txt

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 19 Oct 2015 02:14:38 +0000

Hi DOTS Chairs,
May I request for a 5 or 10 minutes time slot for presenting the following draft, as an input for the discussion about attack telemetry information?

Thanks a lot!

B.R.
Frank

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 
发送时间: 2015年10月19日 10:04
收件人: Dacheng Zhang; DaCheng Zhang; Futianfu; Xialiang (Frank); limin 00223961; limin 00223961; Futianfu; Xialiang (Frank)
主题: New Version Notification for draft-fu-dots-ipfix-extension-00.txt

A new version of I-D, draft-fu-dots-ipfix-extension-00.txt
has been successfully submitted by Liang Xia and posted to the IETF repository.

Name:		draft-fu-dots-ipfix-extension
Revision:	00
Title:		IPFIX IE Extensions for DDoS Attack Detection
Document date:	2015-10-19
Group:		Individual Submission
Pages:		21
URL:            https://www.ietf.org/internet-drafts/draft-fu-dots-ipfix-extension-00.txt
Status:         https://datatracker.ietf.org/doc/draft-fu-dots-ipfix-extension/
Htmlized:       https://tools.ietf.org/html/draft-fu-dots-ipfix-extension-00

Abstract:
   Although most of the existing IP Flow Information Export (IPFIX)
   Information Elements (IEs) are useful for network security
   inspection, there are still some gaps existing to identify a number
   of categories of the attacks.  To fill in the gaps, this document
   defines some new IPFIX IEs and describes their formats for
   inspecting network security.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: "Roland Dobbins" <[email-masked]>
Date: Mon, 19 Oct 2015 10:18:38 +0700

On 19 Oct 2015, at 9:14, Xialiang (Frank) wrote:

> May I request for a 5 or 10 minutes time slot for presenting the 
> following draft, as an input for the discussion about attack telemetry 
> information?

 From the DOTS WG charter:

   The WG will, where appropriate, reuse or extend existing standard
   protocols and mechanisms (for example, IPFIX and its associated
   templating and extension mechanisms).

This language in the DOTS WG charter is not intended to suggest a 
general extension of any existing standards such as IPFIX; rather, it is 
intended to note that should an existing standard may be desirable for 
use within the context of threat signaling, the DOTS WG may request an 
extension of said standard to support the DOTS mission of 
standards-based threat signaling.

draft-fu-dots-ipfix-extension-00 does not meet these criteria; it is 
wholly unconcerned with threat signaling.

 From the DOTS WG charter:

   Any modification of or extension to existing protocols must be in 
close coordination with the working
   groups responsible for the protocol being modified, and may be done 
in this working group after agreement
   with all the relevant WGs and responsible Area Directors.

The above criteria from the DOTS WG charter have not been fulfilled with 
regards to any proposed extension of IPFIX.

It is respectfully suggested to the chairs that this draft (as in its 
previous iteration) is more suited for the (currently Concluded) IPFIX 
WG, as it is not directly related to the potential use of IPFIX for 
threat signaling, but is more of a proposed general extension of IPFIX.  
As such, its authors would more profitably direct their efforts in this 
regard by petitioning for a reopening of the IPFIX WG.

-----------------------------------
Roland Dobbins <[email-masked]>

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 19 Oct 2015 03:33:48 +0000

Hi Roland and all,
See my clarifications:

-----邮件原件-----
发件人: Dots [mailto:[email-masked]] 代表 Roland Dobbins
发送时间: 2015年10月19日 11:19
收件人: dots
抄送: Roman D. Danyliw; Tobias Gondrom
主题: Re: [Dots] New Version Notification for draft-fu-dots-ipfix-extension-00.txt

This language in the DOTS WG charter is not intended to suggest a general extension of any existing standards such as IPFIX; rather, it is intended to note that should an existing standard may be desirable for use within the context of threat signaling, the DOTS WG may request an extension of said standard to support the DOTS mission of standards-based threat signaling.

draft-fu-dots-ipfix-extension-00 does not meet these criteria; it is wholly unconcerned with threat signaling.

[Frank]: It's related with what information about threat or attack can be used for DOTS threat signaling. Do you mean the attack telemetry information is not the goal of DOTS?

   Any modification of or extension to existing protocols must be in close coordination with the working
   groups responsible for the protocol being modified, and may be done in this working group after agreement
   with all the relevant WGs and responsible Area Directors.

The above criteria from the DOTS WG charter have not been fulfilled with regards to any proposed extension of IPFIX.

It is respectfully suggested to the chairs that this draft (as in its previous iteration) is more suited for the (currently Concluded) IPFIX WG, as it is not directly related to the potential use of IPFIX for threat signaling, but is more of a proposed general extension of IPFIX.  

[Frank]: From my perspective, this draft is related to the potential use of IPFIX for the attack telemetry.

As such, its authors would more profitably direct their efforts in this regard by petitioning for a reopening of the IPFIX WG.

_______________________________________________
Dots mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dots

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 20 Oct 2015 08:04:30 -0400

Roland,  If IPFIX meets the requirements for a DOTS transport, then it 
is within scope.

Actually, our next major work item needs to be developing a data model 
and registry of the DOTS signal messages.  This needs to be independent 
of the transport

If JSON over SRTP is the best fit for DOTS transport then it would be in 
scope.  We need a transport, and we have the requirements.  Or at least 
the 00 cut for the requirements.  Let's take a reasonable view of what 
we have out there that can meet those requirements and support a concise 
data representation.

On 10/18/2015 11:18 PM, Roland Dobbins wrote:
>> following draft, as an input for the discussion about attack 
>> telemetry information?
>
> general extension of any existing standards such as IPFIX; rather, it 
> is intended to note that should an existing standard may be desirable 
> for use within the context of threat signaling, the DOTS WG may 
> request an extension of said standard to support the DOTS mission of 
> The above criteria from the DOTS WG charter have not been fulfilled 
> with regards to any proposed extension of IPFIX.
>
> threat signaling, but is more of a proposed general extension of 
> IPFIX.  As such, its authors would more profitably direct their 
> efforts in this regard by petitioning for a reopening of the IPFIX WG.
>

---

From: Andrew Mortensen <[email-masked]>
Date: Tue, 20 Oct 2015 13:46:03 -0400

> On Oct 20, 2015, at 8:04 AM, Robert Moskowitz <[email-masked]> wrote:
> 
> Roland,  If IPFIX meets the requirements for a DOTS transport, then it is within scope.

That’s true, but draft-fu-dots-ipfix-extension refers to DOTS only twice: once as the WG name in the header, and once in the draft name. The rest of the text defines IPFIX extensions that purport to enhance DDoS detection via flow collection, not anything related to DOTS signaling. These extensions may indeed be useful additions to the IPFIX specification—I haven’t seen any evidence one way or the other—but this draft’s relationship to DOTS's goals is not clear to me. Nothing in the draft seems to position it as a solution or supplement for DOTS.

> Actually, our next major work item needs to be developing a data model and registry of the DOTS signal messages.  This needs to be independent of the transport
> 
> If JSON over SRTP is the best fit for DOTS transport then it would be in scope.  We need a transport, and we have the requirements.  Or at least the 00 cut for the requirements.  Let's take a reasonable view of what we have out there that can meet those requirements and support a concise data representation.

Agreed, I’m strongly in favor of continuing this discussion. I’d like to see some feedback on the requirements and use cases first, though.

andrew

>> It is respectfully suggested to the chairs that this draft (as in its previous iteration) is more suited for the (currently Concluded) IPFIX WG, as it is not directly related to the potential use of IPFIX for threat signaling, but is more of a proposed general extension of IPFIX.  As such, its authors would more profitably direct their efforts in this regard by petitioning for a reopening of the IPFIX WG.
>>

---

From: "Roland Dobbins" <[email-masked]>
Date: Wed, 21 Oct 2015 00:50:53 +0700

On 19 Oct 2015, at 10:33, Xialiang (Frank) wrote:

> [Frank]: It's related with what information about threat or attack can 
> be used for DOTS threat signaling.
> Do you mean the attack telemetry information is not the goal of DOTS?

Correct.  This is the DDoS Open Threat Signaling WG, not the IPFIX WG.

> use of IPFIX for the attack telemetry.

Which is not within the scope of this WG.

---

From: "Roland Dobbins" <[email-masked]>
Date: Wed, 21 Oct 2015 01:04:46 +0700

> Roland,  If IPFIX meets the requirements for a DOTS transport, then it 

Concur - that's the very specific meaning of the verbiage to the charter 
which refers to adopting/extending existing standards such as IPFIX, if 
they're deemed useful for fulfilling the mission of DOTS, which is 
threat signaling.

As Andrew Mortensen indicated, draft-fu-dots-ipfix-extension-00 has 
nothing to do with threat signaling - it has to do with the parts of 
draft-ietf-dots-requirements-00 described as 'the mechanism by which 
this process takes place is beyond the scope of this document'.

 From the DOTS perspective, draft-fu-dots-ipfix-extension-00 is 
behind-the-curtains stuff which has no direct applicability to threat 
signaling, and is thus outside the scope of the DOTS WG.  It falls under 
the rubric of the IPFIX WG, which is currently in Concluded status.

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Fri, 23 Oct 2015 19:15:33 +0000

Hello WG!

> -----Original Message-----
> From: Dots [mailto:[email-masked]] On Behalf Of Roland Dobbins
> Sent: Tuesday, October 20, 2015 1:51 PM
> To: dots <[email-masked]>
> Subject: Re: [Dots] New Version Notification for draft-fu-dots-ipfix-
> extension-00.txt
> 

[snip]

> Which is not within the scope of this WG.

The WG chairs in consultation with the AD have reviewed this question of scope given our charter [1].  We're all in agreement that exploring protocol solutions in attack telemetry and IPFIX is in scope for the WG. While the WG hasn't reached consensus on the exact requirements or use cases, early protocol discussion in draft-fu-dots-ipfix-extension-00  (or draft-reddy-dots-transport-01) will help inform the direction of the group and get us closer to WG data model and protocol specifications. 

We hope this clarifies this scope question and we can continue to focus on progressing our work as a WG. If there are any questions or concerns, please let us know and we will be happy to help. 

Roman & Tobias
(DOTS co-chairs)

[1] http://datatracker.ietf.org/wg/dots/charter/

---

From: "Roland Dobbins" <[email-masked]>
Date: Sat, 24 Oct 2015 11:54:52 +0700

On 24 Oct 2015, at 2:15, Roman D. Danyliw wrote:

> If there are any questions or concerns, please let us know and we will 
> be happy to help.

The intent of the language in the charter discussing existing telemetry 
standards was to ensure that the DOTS WG had the option of utilizing 
and/or exploring the extension of said standards within the realm of 
using them for threat signaling and request handling purposes; this was 
the spirit in which it was contributed:

<http://www.ietf.org/mail-archive/web/dots/current/msg00131.html>

The concern is that by getting into details of telemetry format 
definition which are unrelated to threat signaling, we are inadvertently 
embracing the much larger task of general telemetry format redefinition, 
which has implications far beyond the threat signaling arena and is a 
much larger, more involved, and more complex task than defining a threat 
signaling standard.

draft-fu-dots-ipfix-extension-00 is not related to threat signaling.  It 
is related to the underlying generation and export of network traffic 
statistics and characteristics.  From draft-fu-dots-ipfix-extension-00:

    This document presents the IPFIX IEs which are available for the
    network attacks detection, some of them are the new defined IPFIX
    IEs and their formats are specified. The wise utilization of these
    IEs will improve the network security and will support the offline
    analysis of data from different operators in the future with minimal
    resource consumption.

There is nothing in draft-fu-dots-ipfix-extension-00 which relates to 
threat signaling.  Nowhere in draft-fu-dots-ipfix-extension-00 is the 
topic of threat signaling mentioned, even in passing.

I apparently missed an email message from the chairs to the list on this 
topic on 5Oct2015; apologies for this oversight.  The concerns expressed 
above are not based upon any company perspective, as was implied in that 
message, but are the concerns of an individual contributor to the WG 
that we are at risk of inadvertently taking on tasks which are outside 
the realm of threat signaling, thereby making it more difficult to 
accomplish our primary goal of developing a standardized mechanism for 
DDoS threat signaling.

These concerns relate to the risk of inadvertent WG scope-creep, nothing 
more.

 From the DOTS charter:

-----

Any modification of or extension to existing protocols must be in close 
coordination with the working
groups responsible for the protocol being modified, and may be done in 
this working group after agreement with all the relevant WGs and 
responsible Area Directors.

-----

Has this coordination with regards to draft-fu-dots-ipfix-extension-00 
taken place, and has the agreement of the Operations and Management Area 
AD and the IPFIX chairs to this proposed modification to IPFIX been 
secured?

Many thanks!

---

From: "Teague, Nik" <[email-masked]>
Date: Sat, 24 Oct 2015 08:34:56 +0000

On 24 Oct 2015, at 05:55, Roland Dobbins <[email-masked]> wrote:

>> If there are any questions or concerns, please let us know and we will be happy to help.

My 2c

A lot of this discussion is somewhat distracting from the fact that use cases will drive requirements and in turn drive the end result... if that's IPFIX or pigeons is not a direct concern atm.

Thanks,

-Nik

---

From: Tobias Gondrom <[email-masked]>
Date: Sun, 25 Oct 2015 21:20:01 +0100

Hi Frank,

thank you for your explanations.
It could be helpful to explain in more detail in the next version of the 
draft, e.g. in the introduction section, a bit more about the context of 
the draft in relation to threat signaling. People attending the BOFs and 
pre-BOF discussion have the context, but it may be less clear for a new 
reader.

Best regards, Tobias

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 26 Oct 2015 01:54:44 +0000

Hi Nik,
I totally understand and agree with your comments.
IMHO, real use cases drive the right direction, and its value is not related with the protocol.

B.R.
Frank

-----邮件原件-----
发件人: Dots [mailto:[email-masked]] 代表 Teague, Nik
发送时间: 2015年10月24日 16:35
收件人: Roland Dobbins
抄送: Roman D. Danyliw; dots
主题: Re: [Dots] New Version Notification for draft-fu-dots-ipfix-extension-00.txt

My 2c

Thanks,

-Nik

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 26 Oct 2015 02:04:03 +0000

Hi chairs,
You are right! I will include more explanations in the next version of the draft to clarify its relation with threat signaling and the reason why it is useful in DOTS.

Thanks for your concern.

B.R.
Frank

发件人: Tobias Gondrom [mailto:[email-masked]]
发送时间: 2015年10月26日 4:20
收件人: Xialiang (Frank); [email-masked]; [email-masked]
抄送: [email-masked]
主题: Re: [Dots] 答复: New Version Notification for draft-fu-dots-ipfix-extension-00.txt

Hi Frank,

thank you for your explanations.
It could be helpful to explain in more detail in the next version of the draft, e.g. in the introduction section, a bit more about the context of the draft in relation to threat signaling. People attending the BOFs and pre-BOF discussion have the context, but it may be less clear for a new reader.

Best regards, Tobias

Hi Roland and all,

See my clarifications:

-----邮件原件-----

发送时间: 2015年10月19日 11:19

收件人: dots

information?

Roland Dobbins <[email-masked]><mailto:[email-masked]>

Dots mailing list

[email-masked]<mailto:[email-masked]>

Dots mailing list

[email-masked]<mailto:[email-masked]>

---

From: Andrew Mortensen <[email-masked]>
Date: Mon, 26 Oct 2015 09:44:59 -0400

> On Oct 25, 2015, at 4:20 PM, Tobias Gondrom <[email-masked]> wrote:
> 
> Hi Frank, 
> 

For the sake of the archives and the ongoing discussion, can you clarify if these comments are as co-chair or as an individual? Thanks!

andrew

>> 发件人: Dots [mailto:[email-masked] <mailto:[email-masked]>] 代表 Roland Dobbins
>> 发送时间: 2015年10月19日 11:19
>> 收件人: dots
>> Roland Dobbins <[email-masked]> <mailto:[email-masked]>
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/dots <https://www.ietf.org/mailman/listinfo/dots>
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/dots <https://www.ietf.org/mailman/listinfo/dots>
>

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 26 Oct 2015 21:28:32 +0100

Hi Andrew,

thank you for reminding me.
I forgot to explicitly take off my chair hat before replying to Frank. 
Apologies. I shall be more thorough with that.

For the archives, I meant:
<WG chair hat = off>
Hi Frank,

Best regards, Tobias
</WG chair hat = off>

Best, Tobias

On 26/10/15 14:44, Andrew Mortensen wrote:
>
>> On Oct 25, 2015, at 4:20 PM, Tobias Gondrom 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>> Hi Frank,
>>
>> It could be helpful to explain in more detail in the next version of 
>> the draft, e.g. in the introduction section, a bit more about the 
>> context of the draft in relation to threat signaling. People 
>> attending the BOFs and pre-BOF discussion have the context, but it 
>> may be less clear for a new reader.
>
> For the sake of the archives and the ongoing discussion, can you 
> clarify if these comments are as co-chair or as an individual? Thanks!
>
> andrew
>
>
>
>
>>
>>> Roland Dobbins<[email-masked]>
>>>