Subject: [I2nsf] Questions about draft-fang-i2nsf-inter-cloud-ddos-mitigation-api-00

From: Linda Dunbar <[email-masked]>
Date: Mon, 1 Feb 2016 18:11:03 +0000

Lu Yuan and Deepak,

Some questions on your draft:

Section 2 (Problem Statement):

-        DDoS attacks are usually  to hosts, servers, etc. What are included in the DDoS attacks to "Pipe"? Your draft mentioned  "consuming the bandwidth" by unwanted traffic? What else?

-        Your draft stated that "today, exchange of DDoS attack information and mitigation among providers is largely manual". Can you elaborate some details of those "manually exchanged DDoS attack information"?  Those detailed information can help the WG to derive the appropriate information/data model.

-        What does "saturation resistance" mean?  What is the definition of "DDoS absorption resilience of the link"?

-

Section 3:

-        Page 6: the DDoS Protection Types listed are mostly for hosts (end stations). Most pipes between providers have aggregated traffic, so routers on both side of the pipes don't normally see the "TCP flood rate, UDP flood rate, TCP SYN.ACK/RST, etc"

-        BGP Signaling & Mitigation mentioned in Section 3. Are you advocating to use BGP as a way to dispatch the polices to routers on both sides of the pipes and to monitor the traffic through the pipes"?

Thank you very much.

Linda Dunbar

---

From: Luyuan Fang <[email-masked]>
Date: Sun, 7 Feb 2016 06:27:01 +0000

Hi Linda,

Thanks for bringing up the discussion.
See my answers in-line, marked [LF].

Thanks,

Luyuan

From: Linda Dunbar [mailto:[email-masked]]
Sent: Monday, February 1, 2016 10:11 AM
To: Luyuan Fang <[email-masked]>; Deepak Bansal (AZURE) <[email-masked]>; [email-masked]
Subject: Questions about draft-fang-i2nsf-inter-cloud-ddos-mitigation-api-00

Lu Yuan and Deepak,

[LF] The DDoS attack can be targeting the hosts, servers, end-points, gateways, or any devices in between. Regardless of the target, the attack traffic flows through the "Pipes"/inter-connection links, and can saturate these large pipes. Attack volume is the key issue here. DDoS attack BW is increasing very fast is the recent years. Attack BW greater than 100G is not uncommon any more. The DDoS attack can consume BW, impact multi-region Data Centers and Inter-Cloud connectivity, and interrupt multi-services. Because of its massive scale, it can also make fast mitigation more challenging.

-        Your draft stated that "today, exchange of DDoS attack information and mitigation among providers is largely manual". Can you elaborate some details of those "manually
exchanged DDoS attack information"?  Those detailed information can help the WG to derive the appropriate information/data model.
[LF] By manual, we meant no automation. Manual means someone has to send emails, or make phone calls, etc. Basically, it means no signaling, no common API, no automation across the provider boundaries.

-        What does "saturation resistance" mean?  What is the definition of "DDoS absorption resilience of the link"?
[LF] Saturation resistance means that the attack cannot saturate the connection links and make them unusable. DDoS absorption resilience of the link - the attack can be absorbed without taking down the network connections and impact the services.
The design to help to achieve the above include: using larger BW links, having multiple links to the DC, having more peering-points, having redundancy from all layers, etc.

Section 3:

-        Page 6: the DDoS Protection Types listed are mostly for hosts (end stations). Most pipes between providers have aggregated traffic, so routers on both side of the pipes don't normally see the "TCP flood rate, UDP flood rate, TCP SYN.ACK/RST, etc"
[LF] : See my answer to your first question. Router may not be the attack target, but the attack volume it has to forward can render it useless for carrying legitimate traffic.

-        BGP Signaling & Mitigation mentioned in Section 3. Are you advocating to use BGP as a way to dispatch the polices to routers on both sides of the pipes and to monitor the traffic through the pipes"?
[LF] : BGP has been used by all providers for ages, it is extensible and well understood, so it is a primary candidate. However, we are open to hear other options too.

Thank you very much.

Linda Dunbar