Subject: Re: [Dots] TR: New Version Notification for draft-reddy-dots-telemetry-04.txt

From: <[email-masked]>
Date: Fri, 8 Nov 2019 07:58:20 +0000

Hi Kaname, 

Apologies for the delay to have this done.

The draft notes the following:

      Notes: (1) Check naming conflict to ease CBOR mapping (e.g, low-
      percentile is defined as yang:gauge64, list, or container).
      Distinct names may be considered.

Although this is not an issue in YANG, I updated some YANG attribute names to avoid cbor naming conflicts. The updated YANG module is available at: https://github.com/boucadair/draft-dots-telemetry/blob/master/draft-reddy-dots-telemetry-04.txt  

Please find below the mapping table. An online version is also available at: https://github.com/boucadair/draft-dots-telemetry/blob/master/mapping-table.txt.   

   +----------------------+-------------+------+---------------+--------+
   | Parameter Name       | YANG        | CBOR | CBOR Major    | JSON   |
   |                      | Type        | Key  |    Type &     | Type   |
   |                      |             |      | Information   |        |
   +----------------------+-------------+------+---------------+--------+
   | ietf-dots-signal-cha |             |      |               |        |
   | nnel:telemetry       | container   |0x8008| 5 map         | Object |
   | tcid                 | uint32      |0x8009| 0 unsigned    | Number |
   | telemetry-config     | container   |0x800A| 5 map         | Object |
   | low-percentile       | decimal64   |0x800B| 6 tag 4       |        |
   |                      |             |      |  [-2, integer]| String |
   | mid-percentile       | decimal64   |0x800C| 6 tag 4       |        |
   |                      |             |      |  [-2, integer]| String |
   | high-percentile      | decimal64   |0x800D| 6 tag 4       |        |
   |                      |             |      |  [-2, integer]| String |
   | unit-config          | list        |0x800E| 4 array       | Array  |
   | unit                 | enumeration |0x800F| 0 unsigned    | String |
   | status               | boolean     |0x8010| 7 bits 20     | False  |
   |                      |             |      | 7 bits 21     | True   |
   | total-pipe-capability| list        |0x8011| 4 array       | Array  |
   | pipe                 | uint64      |0x8012| 0 unsigned    | String |
   | pre-mitigation       | list        |0x8013| 4 array       | Array  |
   | telemetry-id         | uint32      |0x8014| 0 unsigned    | Number |
   | total-traffic-       |             |      |               |        |
   |    normal-baseline   | list        |0x8015| 4 array       | Array  |
   | low-percentile-g     | yang:gauge64|0x8016| 0 unsigned    | String |
   | mid-percentile-g     | yang:gauge64|0x8017| 0 unsigned    | String |
   | high-percentile-g    | yang:gauge64|0x8018| 0 unsigned    | String |
   | peak-g               | yang:gauge64|0x8019| 0 unsigned    | String |
   | total-attack-traffic | list        |0x801A| 4 array       | Array  |
   | total-traffic        | list        |0x801B| 4 array       | Array  |
   | total-connection-    |             |      |               |        |
   |        capacity      | list        |0x801C| 4 array       | Array  |
   | connection           | uint64      |0x801D| 0 unsigned    | String |
   | connection-client    | uint64      |0x801E| 0 unsigned    | String |
   | embryonic            | uint64      |0x801F| 0 unsigned    | String |
   | embryonic-client     | uint64      |0x8020| 0 unsigned    | String |
   | connection-ps        | uint64      |0x8021| 0 unsigned    | String |
   | connection-client-ps | uint64      |0x8022| 0 unsigned    | String |
   | request-ps           | uint64      |0x8023| 0 unsigned    | String |
   | request-client-ps    | uint64      |0x8024| 0 unsigned    | String |
   | partial-request-ps   | uint64      |0x8025| 0 unsigned    | String |
   | mitigation-start     | uint64      |0x8026| 0 unsigned    | String |
   | partial-request-     |             |      |               |        |
   |        client-ps     | uint64      |0x8027| 0 unsigned    | String |
   | total-attack-        |             |      |               |        |
   |        connection    | container   |0x8028| 5 map         | Object |
   | low-percentile-l     | list        |0x8029| 4 array       | Array  |
   | mid-percentile-l     | list        |0x802A| 4 array       | Array  |
   | high-percentile-l    | list        |0x802B| 4 array       | Array  |
   | peak                 | list        |0x802C| 4 array       | Array  |
   | attack-detail        | container   |0x802D| 5 map         | Object |
   | vendor-id            | uint32      |0x802E| 0 unsigned    | Number |
   | attack-id            | string      |0x802F| 3 text string | String |
   | attack-name          | string      |0x8030| 3 text string | String |
   | attack-severity      | enumeration |0x8031| 0 unsigned    | String |
   | start-time           | uint64      |0x8032| 0 unsigned    | String |
   | end-time             | uint64      |0x8033| 0 unsigned    | String |
   | source-count         | container   |0x8034| 5 map         | Object |
   | top-talker           | container   |0x8035| 5 map         | Object |
   | spoofed-status       | boolean     |0x8036| 7 bits 20     | False  |
   |                      |             |      | 7 bits 21     | True   |
   | low-percentile-c     | container   |0x8037| 5 map         | Object |
   | mid-percentile-c     | container   |0x8038| 5 map         | Object |
   | high-percentile-c    | container   |0x8039| 5 map         | Object |
   | peak-c               | container   |0x803A| 5 map         | Object |
   +----------------------+-------------+------+---------------+--------+

Cheers,
Med

> -----Message d'origine-----
> De : Dots [mailto:[email-masked]] De la part de
> [email-masked]
> Envoyé : mercredi 23 octobre 2019 13:25
> À : kaname nishizuka; [email-masked]
> Objet : Re: [Dots] TR: New Version Notification for draft-reddy-dots-
> telemetry-04.txt
> 
> Hi Kaname,
> 
> Thank you for sharing the feedback.
> 
> We will prepare an initial version of the mapping table that we will put on
> the github. That table will be integrated in the next iteration of the
> draft.
> 
> Cheers,
> Med
> 
> > -----Message d'origine-----
> > De : kaname nishizuka [mailto:[email-masked]]
> > Envoyé : mercredi 23 octobre 2019 11:07
> > À : BOUCADAIR Mohamed TGI/OLN; [email-masked]
> > Objet : Re: [Dots] TR: New Version Notification for draft-reddy-dots-
> > telemetry-04.txt
> >
> > Hi Med, all,
> >
> > I'm planning to implement dots telemetry features into go-dots.
> > Though it would evolve, ifan initial version of yang/cbor mapping was
> > defined, it helps me a lot.
> >
> > thanks,
> > Kaname
> >
> >
> > On 2019/10/18 18:38, [email-masked] wrote:
> > > Hi all,
> > >
> > > Although we are waiting for a call for adoption for this draft, we made
> > some changes which you can track with the diff provided below.
> > >
> > > Cheers,
> > > Med
> > >
> > >> -----Message d'origine-----
> > >> De : [email-masked] [mailto:[email-masked]]
> > >> Envoyé : vendredi 18 octobre 2019 11:33
> > >> À : chenmeiling; BOUCADAIR Mohamed TGI/OLN; Meiling Chen; Tirumaleswar
> > >> Reddy; Ehud Doron; Reddy K
> > >> Objet : New Version Notification for draft-reddy-dots-telemetry-04.txt
> > >>
> > >>
> > >> A new version of I-D, draft-reddy-dots-telemetry-04.txt
> > >> has been successfully submitted by Mohamed Boucadair and posted to the
> > >> IETF repository.
> > >>
> > >> Name:		draft-reddy-dots-telemetry
> > >> Revision:	04
> > >> Title:		Distributed Denial-of-Service Open Threat Signaling
> (DOTS)
> > >> Telemetry
> > >> Document date:	2019-10-18
> > >> Group:		Individual Submission
> > >> Pages:		41
> > >> URL:            https://www.ietf.org/internet-drafts/draft-reddy-dots-
> > >> telemetry-04.txt
> > >> Status:         https://datatracker.ietf.org/doc/draft-reddy-dots-
> > >> telemetry/
> > >> Htmlized:       https://tools.ietf.org/html/draft-reddy-dots-
> telemetry-
> > 04
> > >> Htmlized:       https://datatracker.ietf.org/doc/html/draft-reddy-
> dots-
> > >> telemetry
> > >> Diff:           https://www.ietf.org/rfcdiff?url2=draft-reddy-dots-
> > >> telemetry-04
> > >>
> > >> Abstract:
> > >>     This document aims to enrich DOTS signal channel protocol with
> > >>     various telemetry attributes allowing optimal DDoS attack
> > mitigation.
> > >>     This document specifies the normal traffic baseline and attack
> > >>     traffic telemetry attributes a DOTS client can convey to its DOTS
> > >>     server in the mitigation request, the mitigation status telemetry
> > >>     attributes a DOTS server can communicate to a DOTS client, and the
> > >>     mitigation efficacy telemetry attributes a DOTS client can
> > >>     communicate to a DOTS server.  The telemetry attributes can assist
> > >>     the mitigator to choose the DDoS mitigation techniques and perform
> > >>     optimal DDoS attack mitigation.
> > >>
> > >>
> > >>
> > >>
> > >> Please note that it may take a couple of minutes from the time of
> > >> submission
> > >> until the htmlized version and diff are available at tools.ietf.org.
> > >>
> > >> The IETF Secretariat
> > > _______________________________________________
> > > Dots mailing list
> > > [email-masked]
> > > https://www.ietf.org/mailman/listinfo/dots
> 
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: kaname nishizuka <[email-masked]>
Date: Fri, 8 Nov 2019 20:16:27 +0900

Hi Med,

Thanks! I'll look into and use it.

kaname

---

From: H Y <[email-masked]>
Date: Wed, 13 Nov 2019 18:18:52 +0900

Hi draft authors,

Thank you for updating the draft. I have a question about YANG module
of current DOTS telemetry, especially about top-talker.

I think that top-talker has several meaning in general. Which
top-talker can the YANG module explain?
 1) Top-talker of victims.
 2) Top-talker of each victim.
# IMO, current YANG module can explain 1) , but can not 2) when
target-prefix* has several elements.

I attached a slide about the question. I'm glad if you answer the question.

Thanks,
Yuhei

2019年10月18日(金) 18:38 <[email-masked]>:
>
> Hi all,
>
> Although we are waiting for a call for adoption for this draft, we made some changes which you can track with the diff provided below.
>
> Cheers,
> Med
>
> > Title:                Distributed Denial-of-Service Open Threat Signaling (DOTS)
> > Telemetry
> > Htmlized:       https://tools.ietf.org/html/draft-reddy-dots-telemetry-04
> > Htmlized:       https://datatracker.ietf.org/doc/html/draft-reddy-dots-
> > telemetry
> >    various telemetry attributes allowing optimal DDoS attack mitigation.

-- 
----------------------------------
Yuuhei HAYASHI
08065300884
[email-masked]
[email-masked]
----------------------------------

---

From: <[email-masked]>
Date: Wed, 13 Nov 2019 09:40:08 +0000

Hi Yuhei, 

A victim (target) can be identified by one or + target-prefixes. 

The YANG module allows to return many pre-mitigations; each with a target clause:

             +--rw pre-mitigation* [telemetry-id]
                +--rw telemetry-id                     uint32
                +--rw target
                ...
                +--ro attack-detail
                   ...
                   | 
                   +--ro top-talker

A server can aggregate top-talkers for all targets of a domain, or when justified, send specific information (including top-talkers) per individual targets.

Cheers,
Med

> De : H Y [mailto:[email-masked]]
> Envoyé : mercredi 13 novembre 2019 10:19
> À : [email-masked]
> Cc : [email-masked]
> > >    various telemetry attributes allowing optimal DDoS attack mitigation

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 13 Nov 2019 09:45:51 +0000

In addition, the attack details can be sent by the DOTS client or the DOTS server. The client can also choose to send the attack details per target or aggregate top talkers for all talkers of a domain. 

-Tiru

> -----Original Message-----
> From: Dots <[email-masked]> On Behalf Of
> Sent: Wednesday, November 13, 2019 3:10 PM
> To: H Y <[email-masked]>; [email-masked]
> Cc: [email-masked]
> Subject: Re: [Dots] TR: New Version Notification for draft-reddy-dots-
> telemetry-04.txt
> 
> CAUTION: External email. Do not click links or open attachments unless you
> recognize the sender and know the content is safe.
> 
> Hi Yuhei,
> 
> A server can aggregate top-talkers for all targets of a domain, or when
> justified, send specific information (including top-talkers) per individual
> targets.
> 
> Cheers,
> Med
> 
> > De : H Y [mailto:[email-masked]] Envoyé : mercredi 13
> > novembre 2019 10:19 À : [email-masked]
> > Cc : [email-masked]
> > > > Envoyé : vendredi 18 octobre 2019 11:33 À : chenmeiling; BOUCADAIR
> > > > Mohamed TGI/OLN; Meiling Chen; Tirumaleswar Reddy; Ehud Doron;
> > > > Reddy K Objet : New Version Notification for
> > > > draft-reddy-dots-telemetry-04.txt
> > > >
> > > >
> > > > A new version of I-D, draft-reddy-dots-telemetry-04.txt has been
> > > > successfully submitted by Mohamed Boucadair and posted to the IETF
> > > > repository.
> > > >
> > > > mitigation

---

From: H Y <[email-masked]>
Date: Thu, 14 Nov 2019 07:53:45 +0900

Hi Med, Tiru

Thank you for the quick response. :-) That question of mine has been
almost solved.

> > The YANG module allows to return many pre-mitigations; each with a target
I missed it. I understand it as below now.

> > >  2) Top-talker of each victim.
To send 1), several target victim (target) addresses should be
included in the target-prefix*.
To send 2), each target victim (target) address should be included in
the list of target-prefix* in each pre-mitigation, and several
pre-mitigations should be included in the pre-mitigation*.

Thanks,
Yuhei

---

From: kaname nishizuka <[email-masked]>
Date: Sat, 16 Nov 2019 11:21:27 +0900

Hi Med,

One quick suggestion.

It would be worth to refer to [draft-ietf-dots-signal-filter-control] after this sentence
https://github.com/boucadair/draft-dots-telemetry/blob/7b8d2bce108ae45d677e97143fcb985b9a9aa74b/draft-reddy-dots-telemetry-04.txt#L414-L418

like:
The rate-limit action can be controlled by signal-channel [draft-ietf-dots-signal-filter-control] with more possibility than data-channel even when the pipe is overwhelmed

thanks,
Kaname

---

From: kaname nishizuka <[email-masked]>
Date: Sat, 16 Nov 2019 12:28:42 +0900

Hi Med, all,

I've just arrived at the hackathon venue.

To start with, I'd like to suggest one change to the current pre-migation spec.

 From yang module on page 19, in "telemetry" tree (with URI-path "telemetry"):
here is the configuration part.
           +--rw telemetry* [cuid tcid]
              +--rw cuid                     string
              +--rw cdid?                    string
              +--rw tcid                     uint32
              +--rw telemetry-config
              |  +--rw low-percentile?    percentile
              |  +--rw mid-percentile?    percentile
              |  +--rw high-percentile?   percentile
              |  +--rw unit-config* [unit]
              |     +--rw unit      unit
              |     +--rw status?   boolean
Capacity things will be also a part of configuration. (it would work with tcid)
However, attack-detail is *NOT* a configuration.

How about separating these resources like this,
URI-path "telemetry-config":
     telemetry-config and capacity things
URI-path "telemetry":
     periodical traffic/connection metric and attack-detail (if exist)

regards,
Kaname

---

From: <[email-masked]>
Date: Mon, 18 Nov 2019 06:48:58 +0000

Hi Kaname, 

Yes. If we assume that a filter exists, it can be controlled via the signal channel. 

Will update accordingly. Thank you.

Cheers,
Med

> Envoyé : samedi 16 novembre 2019 03:21
> https://github.com/boucadair/draft-dots-
> telemetry/blob/7b8d2bce108ae45d677e97143fcb985b9a9aa74b/draft-reddy-dots-
> telemetry-04.txt#L414-L418
> 
> like:
> The rate-limit action can be controlled by signal-channel [draft-ietf-dots-
> signal-filter-control] with more possibility than data-channel even when
> the pipe is overwhelmed
> 
> thanks,
> Kaname
>

---

From: <[email-masked]>
Date: Mon, 18 Nov 2019 12:59:52 +0000

Hi Kaname,

Thank you for the feedback. I added an issue for this: https://github.com/boucadair/draft-dots-telemetry/issues/1 

An alternative approach would be to define a distinct contain for configuration-related data under the telemetry.

Looking forward reading your Hackathon report.  

Cheers,
Med

> De : Dots [mailto:[email-masked]] De la part de kaname nishizuka
> Envoyé : samedi 16 novembre 2019 04:29
> >> Although this is not an issue in YANG, I updated some YANG attribute
> names to avoid cbor naming conflicts. The updated YANG module is available
> at: https://github.com/boucadair/draft-dots-telemetry/blob/master/draft-
> reddy-dots-telemetry-04.txt
> >>
> >> Please find below the mapping table. An online version is also available
> at: https://github.com/boucadair/draft-dots-telemetry/blob/master/mapping-
> table.txt.
> >>

---

From: kaname nishizuka <[email-masked]>
Date: Tue, 19 Nov 2019 15:10:17 +0900

Hi Med,

thanks.
The presentation slide is now on the site of meeting materials.

It might be better for the discussion at the Friday meeting if you could look at it beforehand.

regards,
Kaname