Subject: [Dots] I-D Action: draft-ietf-dots-telemetry-18.txt

From: [email-masked]
Date: Mon, 13 Dec 2021 02:48:44 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DDoS Open Threat Signaling WG of the IETF.

        Title           : Distributed Denial-of-Service Open Threat Signaling (DOTS) Telemetry
        Authors         : Mohamed Boucadair
                          Tirumaleswar Reddy
                          Ehud Doron
                          Meiling Chen
                          Jon Shallow
	Filename        : draft-ietf-dots-telemetry-18.txt
	Pages           : 116
	Date            : 2021-12-13

Abstract:
   This document aims to enrich the DOTS signal channel protocol with
   various telemetry attributes, allowing for optimal Distributed
   Denial-of-Service (DDoS) attack mitigation.  It specifies the normal
   traffic baseline and attack traffic telemetry attributes a DOTS
   client can convey to its DOTS server in the mitigation request, the
   mitigation status telemetry attributes a DOTS server can communicate
   to a DOTS client, and the mitigation efficacy telemetry attributes a
   DOTS client can communicate to a DOTS server.  The telemetry
   attributes can assist the mitigator to choose the DDoS mitigation
   techniques and perform optimal DDoS attack mitigation.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dots-telemetry/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-dots-telemetry-18

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-telemetry-18

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: <[email-masked]>
Date: Mon, 13 Dec 2021 10:51:00 +0000

Hi Ben, all,

This version integrates the AD review.

Please let us know if there are issues we didn't address. Thank you. 

Cheers,
Med

> -----Message d'origine-----
> De : I-D-Announce <[email-masked]> De la part de internet-
> [email-masked]
> Envoyé : lundi 13 décembre 2021 11:49
> À : [email-masked]
> Cc : [email-masked]
> Objet : I-D Action: draft-ietf-dots-telemetry-18.txt
> 
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html or
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 28 Dec 2021 07:52:03 -0800

> Please let us know if there are issues we didn't address. Thank you. 

Thanks, and sorry for not tending to my email more quickly.

You probably already saw the handful of replies I sent to the email thread
(and https://github.com/boucadair/draft-dots-telemetry/pull/10).

I do not think I saw a reply to this remark on Section 8.1:

===
   In order to signal telemetry data in a mitigation efficacy update, it
   is RECOMMENDED that the DOTS client has already established a DOTS
   telemetry setup session with the server in 'idle' time.

If I understand correctly, it seems that at least part of the need for
having a preestablished telemetry session is that the mitigation
efficacy update is identified only by the 'mid', and so we cannot
specify a 'tmid' as part of such an efficacy update.  Thus, in order
for the server to associate the telemetry data in the efficacy update
with an ongoing telemetry status session, the 'tsid' must be associated
with the 'mid' that is the subject of the efficacy update.
If that is correct, then I think we should have some text here about how
the efficacy update does not/cannot include the 'tmid', and so is
associated with the 'mid' of the update.
===

Of the things in the email chain, I am most interested in getting clarity
around:

- what to put in the "attack-id" field when we are sending an
  "attack-description" string for a not-previously-characterized attack (or
  make that field not mandatory at the YANG level).

- when a server updates its published attack mappings, if there's a
  requirement/expectation that already assigned attack-id values retain the
  same meaning.

Thanks again,

Ben