Subject: [Idr] Fwd: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

From: Youjianjie <[email-masked]>
Date: Mon, 19 Oct 2015 02:08:35 +0000

Dear all,

This document proposes a new BGP path attribute called "Flow Extended Attribute", which carries expected valid period information for a FlowSpec rule.
Could you please review? Your comments are welcome.

Thanks,
Jianjie

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 
发送时间: 2015年10月19日 9:58
收件人: Liangqiandeng; Zhuangshunwan; Youjianjie; Zhuangshunwan; Youjianjie; Liangqiandeng
主题: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

A new version of I-D, draft-liang-idr-bgp-flowspec-time-00.txt
has been successfully submitted by Jianjie You and posted to the IETF repository.

Name:		draft-liang-idr-bgp-flowspec-time
Revision:	00
Title:		BGP FlowSpec with Time Constraints
Document date:	2015-10-18
Group:		Individual Submission
Pages:		9
URL:            https://www.ietf.org/internet-drafts/draft-liang-idr-bgp-flowspec-time-00.txt
Status:         https://datatracker.ietf.org/doc/draft-liang-idr-bgp-flowspec-time/
Htmlized:       https://tools.ietf.org/html/draft-liang-idr-bgp-flowspec-time-00

Abstract:
   The BGP flow specification (FlowSpec) is an additional tool to
   mitigate the effects of Distributed Denial of Service (DDoS) attacks.
   Since DDoS attacks are dynamic, filtering of a flow may only be
   necessary for some specified time, and be undesirable at other times.
   This document proposes a new BGP path attribute called "Flow Extended
   Attribute", which carries expected valid period information for a
   FlowSpec rule.  So network administrators can control certain types
   of traffic in a specified period.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: "Thomas Mangin" <[email-masked]>
Date: Mon, 19 Oct 2015 06:58:36 +0100

Hello Jianjie,

Could you please explain why you choose a TLV vs individual new flow 
components. Naively, I would have thought that it would be easier to 
create a number of new individual tests (start time, duration, delay, 
..).

While I am sympathetic to the idea, many of ExaBGP’s users have asked 
me to introduce a similar feature in the code, I would rather not see 
yet another TLV requiring yes another custom parser to be handled when 
RFC 5575 has a perfectly good generic mechanism to handle tests on flow 
routes.

Yours sincerely,

Thomas Mangin

http://exa.net.uk/about/contact-us
On 19 Oct 2015, at 3:08, Youjianjie wrote:

> FlowSpec rule.
> URL:            
> https://www.ietf.org/internet-drafts/draft-liang-idr-bgp-flowspec-time-00.txt
> Status:         
> https://datatracker.ietf.org/doc/draft-liang-idr-bgp-flowspec-time/
> Htmlized:       
> https://tools.ietf.org/html/draft-liang-idr-bgp-flowspec-time-00
>
>
> Abstract:
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at 
> tools.ietf.org.
>
> The IETF Secretariat
>
> _______________________________________________
> Idr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/idr

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 19 Oct 2015 16:19:47 -0400

Jianjie,

> Could you please review? Your comments are welcome.

I've given some commentary on the time constraints later in the thread.

The description TLV is problematic for a few reasons:
0. Please use UTF-8 encoding for proposals rather than ASCII. :-)

1. They take space in the PDU.  In some cases we're getting close to packing
full BGP PDUs and I suspect the operational benefit of a description is low.
If you must use space for such things, consider some sort of 64-bit number
instead.  Community encoding may be more appropriate.

2. The scoping of this information is a bit too broad.  Especially in a DoS
mitigation context, do you *really* want to tell your downstreams the
information that's attached to the description?  The security ADs might call
this a privacy consideration.

-- Jeff

---

From: Youjianjie <[email-masked]>
Date: Fri, 23 Oct 2015 06:26:47 +0000

Hi Thomas,

Thanks for your comments. 
The "Flow Validity Period" is proposed for the FlowSpec NLRI instead of FlowSpec components (e.g. filters). The filters defined in RFC5575 are used to match the packets; however, the "Flow Validity Period" is an attribute of the FlowSpec rule itself, not acting as a filter, in this document.

Thanks,
Jianjie

> -----邮件原件-----
> 发件人: Idr [mailto:[email-masked]] 代表 Thomas Mangin
> 发送时间: 2015年10月19日 13:59
> 收件人: [email-masked]
> 主题: Re: [Idr] New Version Notification for
> draft-liang-idr-bgp-flowspec-time-00.txt
> 
> Hello Jianjie,
> 
> components. Naively, I would have thought that it would be easier to create a
> number of new individual tests (start time, duration, delay, ..).
> 
> While I am sympathetic to the idea, many of ExaBGP’s users have asked me to
> introduce a similar feature in the code, I would rather not see yet another TLV
> requiring yes another custom parser to be handled when RFC 5575 has a
> perfectly good generic mechanism to handle tests on flow routes.
> 
> Yours sincerely,
> 
> Thomas Mangin
> 
> > FlowSpec rule.  So network administrators can control certain types of
> > traffic in a specified period.
> >
> >
> >
> >
> >

---

From: Youjianjie <[email-masked]>
Date: Fri, 23 Oct 2015 07:48:31 +0000

Hi Jeff, 

> -----邮件原件-----
> 发件人: Jeffrey Haas [mailto:[email-masked]]
> 发送时间: 2015年10月20日 4:20
> 收件人: Youjianjie
> 抄送: [email-masked]
> 主题: Re: [Idr] Fwd: New Version Notification for
> Attribute", which carries expected valid period information for a FlowSpec rule.

OK, we'll consider this, thanks!

> instead.  Community encoding may be more appropriate.

Do you mean using "Flow-ID" instead of "Flow Description"?

> this a privacy consideration.

This information ("Flow Description") is optional. It is for diagnosing purpose. If the information is private, so don't need to tell.