From nobody Wed Jul 1 03:35:46 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 889BE1A8725 for ; Wed, 1 Jul 2015 03:35:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hBfYuvulH039 for ; Wed, 1 Jul 2015 03:35:39 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F7191A8720 for ; Wed, 1 Jul 2015 03:35:39 -0700 (PDT) Received: from pawpaw.sei.cmu.edu (pawpaw.sei.cmu.edu [10.64.21.22]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id t61AZcTp005963 for ; Wed, 1 Jul 2015 06:35:38 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1435746938; bh=1+mcruFndRaKdamqpE/M4RQPmFplBP8TMrt/kW92Ztw=; h=From:To:Subject:Date:Message-ID:Content-Type:Content-ID: Content-Transfer-Encoding:MIME-Version:Sender:Reply-To:Cc: In-Reply-To:References; b=QfKVN+97B6R0oX+57wMD75opBWxs9mXt52rtabY2x0QrVPs//B/wk8Qa3pT0G+OEK tL3wV1YEGBAFX3ZOTtmpah5u6/AtChWEZ64esozFMRD+vQiNmMrNDmaKog9eWjg/I4 auTzD4k6Bh01O1w74jPVvhCRBYi+ndyaVtbqTqCw= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by pawpaw.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id t61AZit9001150 for ; Wed, 1 Jul 2015 06:35:44 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0210.002; Wed, 1 Jul 2015 06:35:35 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: Soliciting agenda items for Prague meeting (IETF 93) Thread-Index: AdCz6apC0QqyQrSmRlWFs2192aAt5Q== Date: Wed, 1 Jul 2015 10:35:35 +0000 Message-ID: <4E0B6EFE-2971-405A-9157-595815D9FD30@cert.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-ID: <03F2B6F9C693584C85F38068E52C0A06@sei.cmu.edu> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Dots] Soliciting agenda items for Prague meeting (IETF 93) X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2015 10:35:45 -0000 Hello WG participants! The IETF agenda is now final. We have a 1-hour slot on Tuesday from 1740 -= 1840 in Congress Hall II. To date, the following agenda items have been r= equested: ** Charter Overview ** Use Case Discussion - draft-mglt-dots-use-cases-00 (Daniel Migault) - draft-xia-dots-extended-use-cases-00 (Frank Xialiang) draft-fu-ipfix-network-security-01 ** Operator Requirements - Chris Morrow ** Other Drafts (New Requirements, Use Cases, Considerations?) - draft-teague-open-threat-signaling-? (Nik Teague) - draft-reddy-dots-transport-00 (Tiru Reddy) draft-reddy-dots-info-model-00 Please let me know which additional topics you'd like to discuss. Thanks, Roman From nobody Fri Jul 3 06:37:56 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F4A11B2FD8 for ; Fri, 3 Jul 2015 06:37:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F2uKAz4trqPd for ; Fri, 3 Jul 2015 06:37:53 -0700 (PDT) Received: from mail-pa0-x229.google.com (mail-pa0-x229.google.com [IPv6:2607:f8b0:400e:c03::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF8D01B2FCF for ; Fri, 3 Jul 2015 06:37:46 -0700 (PDT) Received: by paceq1 with SMTP id eq1so57583920pac.3 for ; Fri, 03 Jul 2015 06:37:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-type; bh=rozpn9F2sQZxvTYwXmsctAp6ef9NffQEFtSwZCCWxzg=; b=gbJ8uZNQRuZ50jl8z+qdnXD+VL0VLSLxtTOHtqBEckH0jubB6wnr6xL5hx79lolkPp 17fj1dU4LTpposznMjyNE4/+G7LwfqFQcZUxP+Cc3FXUwHAwlic2t1tQBNHL2rjwyKbL 1rgbdd1ucM4OT4syD/uJnIRuQMd0ec7r6uA10= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=rozpn9F2sQZxvTYwXmsctAp6ef9NffQEFtSwZCCWxzg=; b=XbGTorfIF+GW7meQpxx/OcIEt7ml1x8XCdDu15w27truR5PpgYt7vrEDI4Hgorbpg7 M8JUlT3B/ener2++fDvd+wZ4WiXC9GnEDkn60nHWrBjgHpcMgu0bQbdnC86W4rvkLURn j9fa6QFsrhA47SGEPlC4UEo1mo97Kxgf3iieIaGybz/zfuMPqNBOKe918n+VebBzcLU8 IyO34Mk3TnPY4YauT6knUNUkRd6NOkOPRoFjEC/8KERjKI6H56URLx4loyd/lj5UYkrW qxdabz2waP+w3ssWkjHXA8e2Il1Q8sKz765AhSZTRQl2WUqg+AKEDZHLJ1AqV+cpbAWh 6rlg== X-Gm-Message-State: ALoCoQnMWEDHLZAouPZINrV+YIykGbnzOqpTldC0Fz1qA6R001FqowkARLttaPHqBPOitfSuUhhH X-Received: by 10.66.139.41 with SMTP id qv9mr77269032pab.35.1435930666349; Fri, 03 Jul 2015 06:37:46 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id oh4sm9176920pdb.42.2015.07.03.06.37.43 (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 03 Jul 2015 06:37:45 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Fri, 03 Jul 2015 20:37:39 +0700 Message-ID: <709D967A-C7A7-4171-837D-BD57AED85701@arbor.net> In-Reply-To: <6073823821667642A5C884FF3A8807F81F499763@MERCURY.corero.com> References: <20150630020939.10497.81039.idtracker@ietfa.amsl.com> <913383AAA69FF945B8F946018B75898A478809EC@xmb-rcd-x10.cisco.com> <6073823821667642A5C884FF3A8807F81F499763@MERCURY.corero.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Cc: "Tirumaleswar Reddy \(tireddy\)" Subject: Re: [Dots] New Version Notification for draft-reddy-dots-transport-00.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2015 13:37:54 -0000 On 1 Jul 2015, at 0:35, Scott Barvick wrote: > I'd encourage you to join the DOTS efforts and help make DOTS support > this use case as well as the other use cases that we are developing. Concur. This is a good architectural and operational model of the mechanics of DDoS mitigation which would be the ultimate output of DOTS signaling from an organization under attack to an organization performing DDoS mitigation for the targeted organization. If we can update this to include the initial signaling from the targeted organization to the mitigation organization - i.e., the portion of the mitigation chain which is the mandate of this WG - I think this could prove an excellent example of how DOTS fits into that mitigation chain. There's no requirement for a DOTS supplicant node to have any organic detection/classification/traceback mechanism; if a supplicant has that capability, that's potentially useful, but our initial focus with the first phase of this effort is simply to standardize upon a protocol which allows either automated or manually-triggered mitigation requests to be signaled either inter- or intra-organizationally in order to request that DDoS mitigation activities be initiated on an on-demand basis, and which also allows for useful feedback regarding the efficacy and status of said mitigation activities to be signaled back to the requestor. It should be designed so that it can easily be extended to incorporate other desired functionality in future phases of development. Very specifically, this statement: Enterprises typically deploy DDoS monitoring appliances that are capable of inspecting and monitoring traffic to detect potential DDoS threats and generate alarms when some thresholds have been reached. while reflecting a very desirable state of affairs, is somewhat aspirational in nature, at this juncture. While more and more endpoint networks are beginning to investigate and deploy systems which provide these capabilities, it isn't the norm, today. One of the purposes of the DOTS signaling effort is to provide organizations which haven't/can't deploy these types of systems with a signaling mechanism they can utilize to request DDoS mitigation assistance as required. ----------------------------------- Roland Dobbins From nobody Sat Jul 4 23:51:44 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FFC61A8876 for ; Sat, 4 Jul 2015 23:51:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hFCivTmnyTkd for ; Sat, 4 Jul 2015 23:51:40 -0700 (PDT) Received: from mail-oi0-f99.google.com (mail-oi0-f99.google.com [209.85.218.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B04FA1B2BAE for ; Sat, 4 Jul 2015 23:51:40 -0700 (PDT) Received: by oiaf66 with SMTP id f66so4591862oia.0 for ; Sat, 04 Jul 2015 23:51:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:thread-topic:thread-index:date :message-id:references:in-reply-to:accept-language:content-language :user-agent:content-type:content-id:content-transfer-encoding :mime-version; bh=NJzj+qgvhiZ3aEl9DrkijRAjFsKeAKmzaBk0eKvk060=; b=X3Cvvzj1TfEGD5rJg61IyeUDYH6LDWG87B1cXPFaLAYpnrH0Eg9e7vEpqiFERZ8kvM lrj5xm20ONauBcHI6TChwsvDzqfXYcLXMaKxSuawT1yol3OuaenivIIZF9GSpFOHWJqT /r7MuNFElExVnTRpZ0PD1s5uMXie9MSpuu6brfTwHeYNPWSd5MYrXHqSlc4y0AjXQu6Z 3a3JOZXaRbj7U12PD530w33xTrneqXELskVp8couKNk8GrrHbhEvkHlEqODVhjtMu+nt i+Z0FoSMUMyP/RBfFsxuN2bFcqRd+s/tgNl/rqzeTxMlMpcKvnuLXhpeBi2x44+xhr5Y ZCcQ== X-Gm-Message-State: ALoCoQlTiKg+oYB2UnSdjnkDeron62uprBeqxPbXws0/I0tD5G9mw1bIvkCZXmbLHuQIjSlaL6JT/VpUpTiRa7kJTQ/ELnqA0w== X-Received: by 10.141.28.195 with SMTP id f186mr67688506qhe.31.1436079100021; Sat, 04 Jul 2015 23:51:40 -0700 (PDT) Received: from brn1lxmailout02.verisign.com (brn1lxmailout02.verisign.com. [72.13.63.42]) by mx.google.com with ESMTPS id 66sm4944112qky.3.2015.07.04.23.51.39 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sat, 04 Jul 2015 23:51:40 -0700 (PDT) X-Relaying-Domain: verisign.com Received: from brn1wnexcas02.vcorp.ad.vrsn.com (brn1wnexcas02 [10.173.152.206]) by brn1lxmailout02.verisign.com (8.13.8/8.13.8) with ESMTP id t656pc0d020121 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Sun, 5 Jul 2015 02:51:39 -0400 Received: from BRN1WNEXMBX01.vcorp.ad.vrsn.com ([::1]) by brn1wnexcas02.vcorp.ad.vrsn.com ([::1]) with mapi id 14.03.0174.001; Sun, 5 Jul 2015 02:51:18 -0400 From: "Teague, Nik" To: "dots@ietf.org" Thread-Topic: New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuA Date: Sun, 5 Jul 2015 06:51:17 +0000 Message-ID: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> In-Reply-To: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.2.150604 x-originating-ip: [10.173.152.4] Content-Type: text/plain; charset="utf-8" Content-ID: <4FCE5CE1420BF848AE74E4188D409AEF@verisign.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Dots] FW: New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2015 06:51:42 -0000 SGksDQoNCi0wMSBkcmFmdCBzdWJtaXR0ZWQgZm9yIHJldmlldyBhbmQgZGlzY3Vzc2lvbi4NCg0K QXMgYWx3YXlzIC0gY29tbWVudHMgYW5kIGZlZWRiYWNrIGFyZSB3ZWxjb21lIGFuZCBJIGxvb2sg Zm9yd2FyZCB0byBzZWVpbmcNCnlvdSBhbGwgYXQgdGhlIG1lZXRpbmcgaW4gUHJhZ3VlDQoNClRo YW5rcywNCg0KLU5paw0KDQpodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJh ZnQtdGVhZ3VlLW9wZW4tdGhyZWF0LXNpZ25hbGluZy0wMS4NCnR4dA0KDQoNCg0KT24gMDUvMDcv MjAxNSAwNzozNSwgImludGVybmV0LWRyYWZ0c0BpZXRmLm9yZyIgPGludGVybmV0LWRyYWZ0c0Bp ZXRmLm9yZz4NCndyb3RlOg0KDQo+DQo+QSBuZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0LXRlYWd1 ZS1vcGVuLXRocmVhdC1zaWduYWxpbmctMDEudHh0DQo+aGFzIGJlZW4gc3VjY2Vzc2Z1bGx5IHN1 Ym1pdHRlZCBieSBOaWsgVGVhZ3VlIGFuZCBwb3N0ZWQgdG8gdGhlDQo+SUVURiByZXBvc2l0b3J5 Lg0KPg0KPk5hbWU6CQlkcmFmdC10ZWFndWUtb3Blbi10aHJlYXQtc2lnbmFsaW5nDQo+UmV2aXNp b246CTAxDQo+VGl0bGU6CQlPcGVuIFRocmVhdCBTaWduYWxpbmcgdXNpbmcgUlBDIEFQSSBvdmVy IEhUVFBTIGFuZCBJUEZJWA0KPkRvY3VtZW50IGRhdGU6CTIwMTUtMDctMDUNCj5Hcm91cDoJCUlu ZGl2aWR1YWwgU3VibWlzc2lvbg0KPlBhZ2VzOgkJMTkNCj5VUkw6ICAgICAgICAgICAgDQo+aHR0 cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LXRlYWd1ZS1vcGVuLXRocmVh dC1zaWduYWxpbmctMDENCj4udHh0DQo+U3RhdHVzOiAgICAgICAgIA0KPmh0dHBzOi8vZGF0YXRy YWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXRlYWd1ZS1vcGVuLXRocmVhdC1zaWduYWxpbmcvDQo+ SHRtbGl6ZWQ6ICAgICAgIA0KPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC10ZWFn dWUtb3Blbi10aHJlYXQtc2lnbmFsaW5nLTAxDQo+RGlmZjogICAgICAgICAgIA0KPmh0dHBzOi8v d3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC10ZWFndWUtb3Blbi10aHJlYXQtc2lnbmFs aW5nLTAxDQo+DQo+QWJzdHJhY3Q6DQo+ICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIGEgbWV0aG9k IGJ5IHdoaWNoIGEgZGV2aWNlIG9yIGFwcGxpY2F0aW9uIG1heQ0KPiAgIHNpZ25hbCBpbmZvcm1h dGlvbiByZWxhdGluZyB0byBjdXJyZW50IHRocmVhdCBoYW5kbGluZyB0byBvdGhlcg0KPiAgIGRl dmljZXMvYXBwbGljYXRpb25zIHRoYXQgbWF5IHJlc2lkZSBsb2NhbGx5IG9yIGF0IHRoZSBzZXJ2 aWNlDQo+ICAgcHJvdmlkZXIuICBUaGUgaW5pdGlhbCBmb2N1cyBpcyBkZG9zIG1pdGlnYXRpb247 IGhvd2V2ZXIsIHRoZSBtZXRob2QNCj4gICBtYXkgYmUgZXh0ZW5kZWQgdG8gY29tbXVuaWNhdGUg YW55IHRocmVhdCB0eXBlLiAgVGhpcyB3aWxsIGFsbG93IGZvcg0KPiAgIGEgdmVuZG9yIG9yIHBy b3ZpZGVyIGFnbm9zdGljIGFwcHJvYWNoIHRvIHRocmVhdCBtaXRpZ2F0aW9uIHV0aWxpc2luZw0K PiAgIG11bHRpcGxlIGxheWVycyBvZiBwcm90ZWN0aW9uIGFzIHRoZSBvcGVyYXRvciBzZWVzIGZp dC4NCj4NCj4gICBUaGUgZGlzc2VtaW5hdGlvbiBvZiB0aHJlYXQgaW5mb3JtYXRpb24gd2lsbCBv Y2N1ciB1dGlsaXNpbmcgSlNPTiBSUEMNCj4gICBBUEkgb3ZlciBIVFRQUyBjb21tdW5pY2F0aW9u cyBiZXR3ZWVuIGRldmljZXMvYXBwbGljYXRpb25zIGFuZCB3aWxsDQo+ICAgYmUgYXVnbWVudGVk IGJ5IElQRklYIGFuZCBVRFAgb3IgU0NUUCBmb3Igc2lnbmFsaW5nIHRlbGVtZXRyeQ0KPiAgIGlu Zm9ybWF0aW9uIHJlbGF0aW5nIHRvIGF0dGFja3MgYW5kIHByb3RlY3RlZCBvYmplY3QgZGF0YS4N Cj4NCj4gICBBbiBvcGVuIHN0YW5kYXJkcyBiYXNlZCBhcHByb2FjaCB0byBjb21tdW5pY2F0aW9u IGJldHdlZW4gb24tcHJlbWlzZQ0KPiAgIEREb1MgbWl0aWdhdGlvbiBkZXZpY2VzIGFuZCBzZXJ2 aWNlIHByb3ZpZGVyIGJhc2VkIEREb1MgcHJvdGVjdGlvbg0KPiAgIHNlcnZpY2VzIGFsbG93cyBm b3IgZW50ZXJwcmlzZXMgdG8gaGF2ZSBhIHdpZGVyIHJhbmdlIG9mIG9wdGlvbnMgdG8NCj4gICBi ZXR0ZXIgc2VjdXJlIHRoZWlyIGVudmlyb25tZW50cyB3aXRob3V0IHRoZSBsaW1pdGF0aW9ucyBv ZiB2ZW5kb3INCj4gICBsb2NrLWluLg0KPg0KPg0KPiAgICAgICAgICAgICAgICAgIA0KPiAgICAg ICAgDQo+DQo+DQo+UGxlYXNlIG5vdGUgdGhhdCBpdCBtYXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51 dGVzIGZyb20gdGhlIHRpbWUgb2YNCj5zdWJtaXNzaW9uDQo+dW50aWwgdGhlIGh0bWxpemVkIHZl cnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCj4NCj5UaGUg SUVURiBTZWNyZXRhcmlhdA0KPg0KDQo= From nobody Sun Jul 5 09:53:42 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDFCB1A03D5 for ; Sun, 5 Jul 2015 09:53:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pzjKn7mJ9_r6 for ; Sun, 5 Jul 2015 09:53:40 -0700 (PDT) Received: from mail-pd0-x22e.google.com (mail-pd0-x22e.google.com [IPv6:2607:f8b0:400e:c02::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 125101A039B for ; Sun, 5 Jul 2015 09:53:40 -0700 (PDT) Received: by pdjd13 with SMTP id d13so91857682pdj.0 for ; Sun, 05 Jul 2015 09:53:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=CRbBKqBqHARJ5/h96WZpuJ7mlcYCAw2thUW+zotJ/jw=; b=bGHjZGCOPrH8sdBQhnH14PserHLGsEdu7MFzSm26YGifCJq/EKT0OgmxYR6IH7guHM uQ3to8SvuH+0KEH3QabECLKg9CZN5U9f53u0hi0ciOfYd+HKUnNMnVkLaEnPj0CZMShJ 0T3yIpvulzcuFKk4D6iuvtO5JuGvatFpLIkrQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=CRbBKqBqHARJ5/h96WZpuJ7mlcYCAw2thUW+zotJ/jw=; b=ZA1ho1W5OHx5k/NWzP6/F937MRLd2bfe4wOjz6HAeZX22CmBunzxb2En7oT237HYQF 45okQMrYD7mhxMp04fVuj5JzyppdQw+paJ1DUhYzxxm7+boWbwTg10aQJNkVRgC5hJBf 4fphkSHZLPzexuqtKLNmebBNiIoYvw1VWeosEiF4ZV7eTgSRjSV5yGhQBw26FMaZpGe3 Ef8pSdlU2Qd/fCdvdnYnVu7n3BKj8fAousAJdWivWw+hkA+4TTASUzu+QYsRu3ecGeIm z8dkH4PPlQXGP9regm+5PvJ2xbYNsjUbfWKUTOQ4XFt85DIQnUuvJu7fTkRD2H+TGAOK sdIA== X-Gm-Message-State: ALoCoQkVOlmwM2tEQT5L9qXksaEPD/rFtdKeS17rgRpYMjytQPX77EslxR5aJ6x1cOhnMl+ZbHmb X-Received: by 10.70.102.11 with SMTP id fk11mr96156643pdb.144.1436115219678; Sun, 05 Jul 2015 09:53:39 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id vx5sm15363551pbc.59.2015.07.05.09.53.36 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 05 Jul 2015 09:53:38 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Sun, 05 Jul 2015 23:53:34 +0700 Message-ID: In-Reply-To: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2015 16:53:42 -0000 On 5 Jul 2015, at 13:51, Teague, Nik wrote: > -01 draft submitted for review and discussion. One question which springs to mind regards the inclusion of SCTP in the latest draft. I'm a big fan of SCTP, from a functional perspective; unfortunately, it hasn't been as widely-adopted as it deserves to be, and so its usefulness for this application as a stateful secondary transport is questionable, given the problems likely to be encountered in terms of traversing network access policies/ACLs/firewall rules, NAT policies, proxies, et. al. Can you expound upon the rationale for specifying SCTP in this latest draft? Thanks! ----------------------------------- Roland Dobbins From nobody Sun Jul 5 12:00:45 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A3891ACDC4 for ; Sun, 5 Jul 2015 12:00:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fk91dpNA25iR for ; Sun, 5 Jul 2015 12:00:40 -0700 (PDT) Received: from mail-oi0-f99.google.com (mail-oi0-f99.google.com [209.85.218.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 165691AC438 for ; Sun, 5 Jul 2015 12:00:34 -0700 (PDT) Received: by oiaf66 with SMTP id f66so4873009oia.0 for ; Sun, 05 Jul 2015 12:00:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:thread-topic:thread-index:date :message-id:references:in-reply-to:accept-language:content-language :user-agent:content-type:content-id:content-transfer-encoding :mime-version; bh=PEj4J9lyyAon3CPCEBC25qwNk3q6RFLQzMt/9NxfmKo=; b=QUngrEjKUeCzNrbCFAOpWWc501hCYvPzMba9Pl8OdEmpuTg6XrWSZ9rfdorfyVC9eZ 8mVEJMXRpafqSHdexZgcLT4DxTqHzvEW7VB9TA7SmhcU+hTVo/2GyymSlfe22B2TvLvV eZqGgFC+ka5B0j6MpjbveHYiEwdryU5XT2XQEenvfVpl3EhmNgys15demm7gnWF9+P75 y/a8IXPxciFO3xcL7J68UotoR5rWRD+++d+vAarZFi/LXATdD+rjGwBSgEYtEbZ6kVb0 Fd/hyUKCijfYCZXvbvwcYZ33h+WyIpOiRxWPKKvR68u9znFu8+H7lxBfLexJ3yrqQtYC bvWg== X-Gm-Message-State: ALoCoQn4WNk14g1hPApLx3SqkTlbC+36vcuFvR3Bog3bB6p56yZ1rplL4r4RYoRf8RKh0MDA0uGvWhkIb/qppsKJ2WffjTJ9wQ== X-Received: by 10.140.133.9 with SMTP id 9mr69716788qhf.5.1436122833557; Sun, 05 Jul 2015 12:00:33 -0700 (PDT) Received: from brn1lxmailout01.verisign.com (brn1lxmailout01.verisign.com. [72.13.63.41]) by mx.google.com with ESMTPS id f66sm5350521qkf.1.2015.07.05.12.00.33 (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 05 Jul 2015 12:00:33 -0700 (PDT) X-Relaying-Domain: verisign.com Received: from brn1wnexcas01.vcorp.ad.vrsn.com (brn1wnexcas01 [10.173.152.205]) by brn1lxmailout01.verisign.com (8.13.8/8.13.8) with ESMTP id t65J0Wpx024278 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sun, 5 Jul 2015 15:00:32 -0400 Received: from BRN1WNEXMBX01.vcorp.ad.vrsn.com ([::1]) by brn1wnexcas01.vcorp.ad.vrsn.com ([::1]) with mapi id 14.03.0174.001; Sun, 5 Jul 2015 15:00:11 -0400 From: "Teague, Nik" To: Roland Dobbins , "dots@ietf.org" Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuAgACXawCAADQ7AA== Date: Sun, 5 Jul 2015 19:00:10 +0000 Message-ID: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.2.150604 x-originating-ip: [10.173.152.4] Content-Type: text/plain; charset="utf-8" Content-ID: <494E597E5C30C84C842D1B8E72965216@verisign.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2015 19:00:42 -0000 T24gMDUvMDcvMjAxNSAxNzo1MywgIkRvdHMgb24gYmVoYWxmIG9mIFJvbGFuZCBEb2JiaW5zIg0K PGRvdHMtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgcmRvYmJpbnNAYXJib3IubmV0PiB3 cm90ZToNCg0KPk9uZSBxdWVzdGlvbiB3aGljaCBzcHJpbmdzIHRvIG1pbmQgcmVnYXJkcyB0aGUg aW5jbHVzaW9uIG9mIFNDVFAgaW4gdGhlDQo+bGF0ZXN0IGRyYWZ0LiAgSSdtIGEgYmlnIGZhbiBv ZiBTQ1RQLCBmcm9tIGEgZnVuY3Rpb25hbCBwZXJzcGVjdGl2ZTsNCj51bmZvcnR1bmF0ZWx5LCBp dCBoYXNuJ3QgYmVlbiBhcyB3aWRlbHktYWRvcHRlZCBhcyBpdCBkZXNlcnZlcyB0byBiZSwNCj5h bmQgc28gaXRzIHVzZWZ1bG5lc3MgZm9yIHRoaXMgYXBwbGljYXRpb24gYXMgYSBzdGF0ZWZ1bCBz ZWNvbmRhcnkNCj50cmFuc3BvcnQgaXMgcXVlc3Rpb25hYmxlLCBnaXZlbiB0aGUgcHJvYmxlbXMg bGlrZWx5IHRvIGJlIGVuY291bnRlcmVkDQo+aW4gdGVybXMgb2YgdHJhdmVyc2luZyBuZXR3b3Jr IGFjY2VzcyBwb2xpY2llcy9BQ0xzL2ZpcmV3YWxsIHJ1bGVzLCBOQVQNCj5wb2xpY2llcywgcHJv eGllcywgZXQuIGFsLg0KPg0KPkNhbiB5b3UgZXhwb3VuZCB1cG9uIHRoZSByYXRpb25hbGUgZm9y IHNwZWNpZnlpbmcgU0NUUCBpbiB0aGlzIGxhdGVzdA0KPmRyYWZ0Pw0KDQpDZXJ0YWlubHkgLSBE cmFmdCAtMDAgcmVmZXJlbmNlZCBVRFAgZm9yIHRoZSBzaWduYWxpbmcgY2hhbm5lbCBhbG9uZS4u LiBhcw0KaXQgcGVydGFpbnMgdG8gSVBGSVggYW5kIGZsb3cgZXhwb3J0IGdlbmVyYWxseSB0aGlz IGlzIGNlcnRhaW5seSB0aGUgbW9zdA0KZmFtaWxpYXIgYW5kIGNvbW1vbmx5IGRlcGxveWVkIHRy YW5zcG9ydCwgdGhhdCBJIGVuY291bnRlciBhbnl3YXkuDQoNCkR1cmluZyB0aGUgSUVURjkyIEJP RiBCcmlhbiBUcmFtbWVsIHF1ZXJpZWQgdGhlIHVzZSBvZiBVRFAgYW5kIHJlcXVlc3RlZA0KdGhh dCB3ZSBzZXJpb3VzbHkgY29uc2lkZXIgU0NUUCBhcyBhbiBhbHRlcm5hdGl2ZSBvciBvcHRpb24u ICBJZiBJIHJlY2FsbA0KY29ycmVjdGx5LCBpdCB3YXMgbWVudGlvbmVkIGF0IHRoZSB0aW1lIHRo YXQgVURQIHdhcyBwcmVzZW50IGZvciBiYWNrd2FyZHMNCmNvbXBhdGliaWxpdHkgYW5kIGRpZG7i gJl0IGFwcGVhciB0byBiZSBnb2luZyBhd2F5IGJ1dCBuZXcgd29ybGQgb3JkZXIgd291bGQNCmJl IGJldHRlciBzZXJ2ZWQgZnJvbSBkZXBsb3lpbmcgU0NUUC4gIEluIHRoYXQgcmVnYXJkIEkgdGhv dWdodCBpdCB3YXMNCndvcnRoIGNvbnNpZGVyaW5nIGFzIGEgdHJhbnNwb3J0IG9wdGlvbi4gIEkg dGhpbmsgdGhlcmUgYXJlIG90aGVyDQpwb3RlbnRpYWwgYmVuZWZpdHMgdGhhdCBTQ1RQIGNhbiBv ZmZlciBvdmVyIHRoZSBzdGFuZGFyZCBVRFAgYW5kIFJGQzcwMTENCmhpZ2hsaWdodHMgaXRzIHN0 cmVuZ3RocyBpbiB0aGlzIGNvbnRleHQgYXQgbGVhc3QuICBUaGUgbWFpbiBxdWVzdGlvbiB3aWxs DQpiZSB3aGV0aGVyIHRoZXNlIGFyZSBiZW5lZml0cyBmb3Igb3VyIG5lZWRzIG9yIGp1c3QgYWRk aXRpb25hbCBuZWVkbGVzcw0KY29tcGxleGl0eS4NCg0KSSBzaG91bGQgYWxzbyBtZW50aW9uIHRo YXQgSSByZWNhbGwgQnJpYW4gbWVudGlvbmluZyB0aGF0IGFzIHRoZXJlIHdlcmUgYQ0KZmV3IGV4 YW1wbGVzIG9mIHJ1bm5pbmcgY29kZSBvdXQgdGhlcmUsIHByYWN0aWNhbGl0eSB3b3VsZCBzdWdn ZXN0IHdlIHBpY2sNCnRoZSBzaW1wbGVzdCBpbnRlcnNlY3Rpb24uDQoNCkFzIHlvdSBtZW50aW9u IHRob3VnaCwgdGhlIG1pZGRsZXdhcmUgaXMgd2hlcmUgdGhpbmdzIHdpbGwgYmVjb21lIGNvbXBs ZXgNCmFuZCB1bndpZWxkaWx5IGlmIHdlIHNlbGVjdCB0aGUgX3dyb25nXyB0cmFuc3BvcnQgYW5k IHRoYXTigJlzIHJlYWxseSBnb2luZw0KdG8gYmUgdGhlIGNydXggb2YgdGhlIGRlY2lzaW9uIHBy b2Nlc3Mgd2l0aGluIHRoZSBXRy4gIElFLiBJZiB3ZQ0KZW1waGF0aWNhbGx5IHN0aXB1bGF0ZSB0 cmFuc3BvcnQgWCB3aGVuIGV2ZXJ5dGhpbmcgaW4gYmV0d2VlbiB3aWxsIGJlIGhhcmQNCnByZXNz ZWQgdG8gZGVhbCB3aXRoIGl0IGNvcnJlY3RseSBvciBhdCBhbGwgdGhlbiB3ZSBhcmVu4oCZdCBm dWxmaWxsaW5nIGFueQ0KdXNlZnVsIGZ1bmN0aW9uIGJ5IHB1cnN1aW5nIHRoYXQgY291cnNlIChy ZWdhcmRsZXNzIG9mIGhvdyBmdW5reSB3ZSB0aGluaw0KaXQgbWF5IGJlIG9yIHdoYXQgdGhlIFJG QyBzdGlwdWxhdGVzIE1VU1QgYmUgc3VwcG9ydGVkKS4gIEFuZCB0aGF04oCZcyBvbmUNCm9mIHRo ZSByZWFzb25zIEkgd2VudCB3aXRoIGEgc2ltcGxlIOKAmE9S4oCZIGF0IHRoaXMgc3RhZ2Ugc2lu Y2UgSSB0aGluayBhbGwNCnRoZXNlIGZhY3RvcnMgYmVhciBkaXNjdXNzaW9uL2NvbnNpZGVyYXRp b24gYXMgd2UgbWFrZSBvdXIgY2hvaWNlLg0KDQpJ4oCZZCBsaWtlIHRvIGhlYXIgZXZlcnlvbmUn cyBmdXJ0aGVyIHRob3VnaHRzIG9uIHRoZSBtYXR0ZXIuDQoNClRoYW5rcywNCg0KLU5paw0KDQoN Cg== From nobody Sun Jul 5 12:25:17 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3C4F1ACD28 for ; Sun, 5 Jul 2015 12:25:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LK2nLsBGmhHm for ; Sun, 5 Jul 2015 12:25:15 -0700 (PDT) Received: from mail-pa0-x229.google.com (mail-pa0-x229.google.com [IPv6:2607:f8b0:400e:c03::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AA531ACE3B for ; Sun, 5 Jul 2015 12:24:39 -0700 (PDT) Received: by pacws9 with SMTP id ws9so84813376pac.0 for ; Sun, 05 Jul 2015 12:24:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type:content-transfer-encoding; bh=zGe/VIR8FYYyg+vRcftU3RxsQdipERXm5H+GJCLNKzc=; b=Sz8LIvBZDap4iEvRL+qOkUc5yk432xzBcEzBIcn+wCuHfQYjKKSMYRKwVeHKD3mkNl amVTv4Ba81ptx017dmgrBQCo1xBAOb8643+o43z1kaJNDP0a3wxHnPndnxXm6lMjbwQ7 d01TvTPJrqFHSQpGFa3/jLwr9YwmOonp93KK4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type:content-transfer-encoding; bh=zGe/VIR8FYYyg+vRcftU3RxsQdipERXm5H+GJCLNKzc=; b=JpDuv1EI5+rrXrdgA9UHGdlmkm6Q4dCNUDfH8RPe4nLOWKrNprDSEafPKVVCgptMjn 1kcmPYtKWnvhU1cB1TRCQgSaYZ+JrX0ndsHY3zl2o5hNK2vfEsbVSPqPkU1T2bYo4tpo CWYoSORKEEQkR9ig1abEgiqxSGwluUGdrBXVxrySvkqevxxZBW89UBITDJdWzP17k3hz IZQmUpsQQn/6aeQmgOr8G2q7jsIOhLLaZpKh6QGLt6eWm1CenPT5xa7aYdv7vRgW0de0 kB3Rttd9454vQ2qva85SKifl4Xb7WnGs23HtU4FTEPftL1UzuGDrvkc2z0+mO01YjPBx f0fQ== X-Gm-Message-State: ALoCoQmbEMl+okQNdHqX0YSxnRBG2T/u6gazQR8hPqZk6P1LIe+TyVHQtU8qd6JBw8NRqF6wKivI X-Received: by 10.70.102.226 with SMTP id fr2mr98941213pdb.26.1436124278881; Sun, 05 Jul 2015 12:24:38 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id ja1sm15629392pbc.51.2015.07.05.12.24.36 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 05 Jul 2015 12:24:37 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 02:24:32 +0700 Message-ID: In-Reply-To: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2015 19:25:17 -0000 On 6 Jul 2015, at 2:00, Teague, Nik wrote: > I’d like to hear everyone's further thoughts on the matter. It's pretty well-established that we need a stateful transport alternative, per previous discussion on-list. Unfortunately, it's also pretty well-established that we can't simply assume that SCTP will make it through a given topological path and/or intervening devices/services/policies, especially with regards to endpoint networks, which is where the majority of DOTS supplicants will likely reside. Though it pains me to say it, I simply don't think SCTP can seriously be considered for this application, at least in the initial stages, due to these significant operational concerns. While DOTS is an extremely important initiative which will have a far-reaching positive impact when brought to fruition, it isn't likely to be the 'killer app' which brings SCTP adoption into the mainstream, either. Note that this hasn't anything to do with the availability of code, example implementations, etc. - it's an unfortunate side-effect of the network-policy-based overfiltering and lowest-common-denominator protocol support in the installed base and default configurations, all of which are constant banes to innovation in the Internet space. ----------------------------------- Roland Dobbins From nobody Sun Jul 5 20:22:00 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 884591B2A63 for ; Sun, 5 Jul 2015 20:21:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pl65xC9wFH2T for ; Sun, 5 Jul 2015 20:21:58 -0700 (PDT) Received: from atl4mhob09.myregisteredsite.com (atl4mhob09.myregisteredsite.com [209.17.115.47]) by ietfa.amsl.com (Postfix) with ESMTP id 28EAC1B2A62 for ; Sun, 5 Jul 2015 20:21:57 -0700 (PDT) Received: from mailpod.hostingplatform.com ([10.30.71.203]) by atl4mhob09.myregisteredsite.com (8.14.4/8.14.4) with ESMTP id t663LuRa028498 for ; Sun, 5 Jul 2015 23:21:56 -0400 Received: (qmail 18047 invoked by uid 0); 6 Jul 2015 03:21:56 -0000 X-TCPREMOTEIP: 69.81.157.169 X-Authenticated-UID: wes@mti-systems.com Received: from unknown (HELO ?192.168.1.112?) (wes@mti-systems.com@69.81.157.169) by 0 with ESMTPA; 6 Jul 2015 03:21:56 -0000 Message-ID: <5599F44C.9080001@mti-systems.com> Date: Sun, 05 Jul 2015 23:21:48 -0400 From: Wesley Eddy Organization: MTI Systems User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Roland Dobbins , "dots@ietf.org" References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 03:21:59 -0000 On 7/5/2015 12:53 PM, Roland Dobbins wrote: > > One question which springs to mind regards the inclusion of SCTP in the > latest draft. I'm a big fan of SCTP, from a functional perspective; > unfortunately, it hasn't been as widely-adopted as it deserves to be, > and so its usefulness for this application as a stateful secondary > transport is questionable, given the problems likely to be encountered > in terms of traversing network access policies/ACLs/firewall rules, NAT > policies, proxies, et. al. If UDP traverses the path, then SCTP-in-UDP can as well (e.g. RFC6951). There might be good arguments against SCTP, but this doesn't seem like one of them. -- Wes Eddy MTI Systems From nobody Sun Jul 5 20:48:55 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 074391A1A9A for ; Sun, 5 Jul 2015 20:48:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KxuNWHLlzZgG for ; Sun, 5 Jul 2015 20:48:52 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96A661A1A4D for ; Sun, 5 Jul 2015 20:48:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1291; q=dns/txt; s=iport; t=1436154532; x=1437364132; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=B01qdZY4xpQ7dyf8I+4omfF2b/27LSdit+gFpUxYzQo=; b=nJVte3XimBamIVSeascYQw53hSnKJ3JUnoxwHZ1iCqoYIllrDtbz+v1V JHpR/bEhwE4m9VD1yDvnrkkeMBRFe6kLytD4GCFawEefzwWajcz7eiQpT 8P9w8iujsgPi5LgAAUBQ9De8W0Vygr8cCHTZWnXAvl9ruPkk4j8K4g8yZ w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0AABQAK+plV/5FdJa1cgxJUYAa9WIFkCoV3AoEkORMBAQEBAQEBgQqEIwEBAQQBAQE3NAkOBAIBCA4DBAEBAQoUCQcnCxQJCAIEARIIiCcNx2sBAQEBAQEBAQEBAQEBAQEBAQEBAQETBItLhFU4BoMRgRQBBJQVAaQ9JoI9gT5vgUeBBAEBAQ X-IronPort-AV: E=Sophos;i="5.15,412,1432598400"; d="scan'208";a="165704663" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by alln-iport-8.cisco.com with ESMTP; 06 Jul 2015 03:48:51 +0000 Received: from xhc-aln-x05.cisco.com (xhc-aln-x05.cisco.com [173.36.12.79]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id t663mpSc027039 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 6 Jul 2015 03:48:51 GMT Received: from xmb-rcd-x10.cisco.com ([169.254.15.123]) by xhc-aln-x05.cisco.com ([173.36.12.79]) with mapi id 14.03.0195.001; Sun, 5 Jul 2015 22:48:51 -0500 From: "Tirumaleswar Reddy (tireddy)" To: Wesley Eddy , Roland Dobbins , "dots@ietf.org" Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuAgACoLwCAAK+HAP//svEw Date: Mon, 6 Jul 2015 03:48:51 +0000 Message-ID: <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> In-Reply-To: <5599F44C.9080001@mti-systems.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.65.50.218] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 03:48:54 -0000 > -----Original Message----- > From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Wesley Eddy > Sent: Monday, July 06, 2015 8:52 AM > To: Roland Dobbins; dots@ietf.org > Subject: Re: [Dots] New Version Notification for draft-teague-open-threat= - > signaling-01.txt >=20 > On 7/5/2015 12:53 PM, Roland Dobbins wrote: > > > > One question which springs to mind regards the inclusion of SCTP in > > the latest draft. I'm a big fan of SCTP, from a functional > > perspective; unfortunately, it hasn't been as widely-adopted as it > > deserves to be, and so its usefulness for this application as a > > stateful secondary transport is questionable, given the problems > > likely to be encountered in terms of traversing network access > > policies/ACLs/firewall rules, NAT policies, proxies, et. al. >=20 >=20 > If UDP traverses the path, then SCTP-in-UDP can as well (e.g. RFC6951). >=20 > There might be good arguments against SCTP, but this doesn't seem like on= e of > them. WebRTC for data channels uses SCTP over DTLS over UDP to solve the NAT trav= ersal problem. -Tiru >=20 > -- > Wes Eddy > MTI Systems >=20 > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Sun Jul 5 22:36:27 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 240A81A878B for ; Sun, 5 Jul 2015 22:36:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E4EDD0k4LR2V for ; Sun, 5 Jul 2015 22:36:25 -0700 (PDT) Received: from mail-pa0-x235.google.com (mail-pa0-x235.google.com [IPv6:2607:f8b0:400e:c03::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF15C1A878A for ; Sun, 5 Jul 2015 22:36:24 -0700 (PDT) Received: by pacws9 with SMTP id ws9so90833894pac.0 for ; Sun, 05 Jul 2015 22:36:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=fGQVoBTLmi7M/CV6yuZhECwfrIbtplscVHVKABDYJuQ=; b=fRZ+mXFV3+VBapNj5fS9myqhAe533Cs/lNZl1xbdGl+3E7D9E6GXHTgZs0Z79/yRnx f6Y8h7CHAW98N3Gip1RRUS2mBgPwAj5uwiRtU79U3v5soxI1fqAr9CwfPWesmI2gUaYZ 2JY0uTir4I30jxePkpN9wIY6RDr+hJ0zagzQk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=fGQVoBTLmi7M/CV6yuZhECwfrIbtplscVHVKABDYJuQ=; b=IbndcXPUfIth2CS1/rHoDerbrWKiQzncta0fi1Wf76YIXEGp3iVWUdIz4dwzXhiF8T zGP+b4gP3x9Y+WiEVvZbtoMZBg6YPHHo3GNAa+9SrVBTzAtfydRosz1pVp9rgmRjG+Uz Z4RqD5uP1uTVIZSVYrzNKqOhzD46hnPFqSj8nGwy4ZDTFFSj/iROMbZgMfBhR4iR3ees tJqp81jlTpblHJmqoWmWGGKY62qS1G4hi3kaGfqq/1zoNNH80kRfE7ZLH2KaVpqJg0/T amrgU00g3v0DpuoJ9dy3MFIUzUS38G9CFd0xX2/rxytNglO0mzR9xePBqnFnVrJsC/n6 nTFw== X-Gm-Message-State: ALoCoQl1c4x9DvItXRtQNDExqVTtiTKlBKRYRUB+mQdrsBkPWqzer3/CNzRhkb8xdFh2/uclIwI8 X-Received: by 10.70.55.1 with SMTP id n1mr100029125pdp.21.1436160984506; Sun, 05 Jul 2015 22:36:24 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id t2sm16676266pdo.81.2015.07.05.22.36.21 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 05 Jul 2015 22:36:23 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 12:36:18 +0700 Message-ID: In-Reply-To: <5599F44C.9080001@mti-systems.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 05:36:26 -0000 On 6 Jul 2015, at 10:21, Wesley Eddy wrote: > If UDP traverses the path, then SCTP-in-UDP can as well (e.g. > RFC6951). The point of having an alternative stateful transport is precisely because, in many cases, UDP can't traverse the path due to excessive endpoint-network filtering. ----------------------------------- Roland Dobbins From nobody Sun Jul 5 22:36:57 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CA6D1A878B for ; Sun, 5 Jul 2015 22:36:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zYOEEo4M2baN for ; Sun, 5 Jul 2015 22:36:56 -0700 (PDT) Received: from mail-pd0-x231.google.com (mail-pd0-x231.google.com [IPv6:2607:f8b0:400e:c02::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B2A11A878A for ; Sun, 5 Jul 2015 22:36:56 -0700 (PDT) Received: by pdbdz6 with SMTP id dz6so3908363pdb.0 for ; Sun, 05 Jul 2015 22:36:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=yPPefMAP061v4gtPhKNkOpPhSN7xZahUR6+i23YHYyA=; b=TM9qizGD0orJgnNyCYu0XVzq/UcJUgDGw3Dha/dcuGw09tJCzE29OoRBht2wB1Xkc4 1SYBcMIBYUV/ya4Ws+dNT3IW7szssa7bYQy6P/EcF2bXJKUONRdLsz8dee3pI+ZEqCnC +F1dKOsFHuumAL9eoOlnFzNeLBQBL16+M1wE4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=yPPefMAP061v4gtPhKNkOpPhSN7xZahUR6+i23YHYyA=; b=GxoeBJXeoXzg8TwxvCBtbWF75wTFwUC4JmCf734+8RFgjjcLnE0dXi8Un8f1PQ30tv wfIUSYtkpXJG9wA6METIoLKym5s1pLO9eUrACQyPeqLj69uO3C+S+l//fHPOLspPJkH9 DWCWYddpF0B/WZ+ggaXDyNBccVHgsJXpkScXxR/CVbVYWUZnCU9zQRcAoZ3qJgaTGf/w eHs4UjHuGY7gEPFH01MkVq/IdwJTX49xGcT0AY+JGZdRdDh9Pz6Pkb/DHAByb8ThfNZE mDxB/7cEyL/XTIQMSwfJZo9+biR/5cjhNkevQEkINIqKaJxXkfba3/9UYy4BreBPCZqv IZDA== X-Gm-Message-State: ALoCoQmDUSjPQ+liqoNoGUbhPMoTDrYN0qB7L8JFGIho5vizzwZsuM3WzyaXU/stVT3QAoXzV9nh X-Received: by 10.66.150.169 with SMTP id uj9mr100416201pab.125.1436161015845; Sun, 05 Jul 2015 22:36:55 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id t2sm16676266pdo.81.2015.07.05.22.36.53 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 05 Jul 2015 22:36:54 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 12:36:53 +0700 Message-ID: <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> In-Reply-To: <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 05:36:57 -0000 On 6 Jul 2015, at 10:48, Tirumaleswar Reddy (tireddy) wrote: > WebRTC for data channels uses SCTP over DTLS over UDP to solve the NAT > traversal problem. See previous reply. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 00:11:34 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 501F31A8A52 for ; Mon, 6 Jul 2015 00:11:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.078 X-Spam-Level: ** X-Spam-Status: No, score=2.078 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, CHARSET_FARAWAY_HEADER=3.2, CN_BODY_35=0.339, MIME_8BIT_HEADER=0.3, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EjDAWRdX5ddc for ; Mon, 6 Jul 2015 00:11:30 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B88F1A1EF3 for ; Mon, 6 Jul 2015 00:11:30 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml404-hub.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BYJ48838; Mon, 06 Jul 2015 07:11:28 +0000 (GMT) Received: from SZXEMA411-HUB.china.huawei.com (10.82.72.70) by lhreml404-hub.china.huawei.com (10.201.5.218) with Microsoft SMTP Server (TLS) id 14.3.158.1; Mon, 6 Jul 2015 08:11:27 +0100 Received: from SZXEMA502-MBS.china.huawei.com ([169.254.4.171]) by szxema411-hub.china.huawei.com ([10.82.72.70]) with mapi id 14.03.0158.001; Mon, 6 Jul 2015 15:11:25 +0800 From: "Xialiang (Frank)" To: Roland Dobbins Thread-Topic: [Dots] New Version Notification for draft-reddy-dots-transport-00.txt Thread-Index: AQHQtZYu64ZA46z6tkiLRsSq34ikBp3OAgTA Date: Mon, 6 Jul 2015 07:11:24 +0000 Message-ID: References: <20150630020939.10497.81039.idtracker@ietfa.amsl.com> <913383AAA69FF945B8F946018B75898A478809EC@xmb-rcd-x10.cisco.com> <6073823821667642A5C884FF3A8807F81F499763@MERCURY.corero.com> <709D967A-C7A7-4171-837D-BD57AED85701@arbor.net> In-Reply-To: <709D967A-C7A7-4171-837D-BD57AED85701@arbor.net> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.135.43.91] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Cc: "dots@ietf.org" , "Tirumaleswar Reddy \(tireddy\)" Subject: [Dots] =?gb2312?b?tPC4tDogIE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBm?= =?gb2312?b?b3IgZHJhZnQtcmVkZHktZG90cy10cmFuc3BvcnQtMDAudHh0?= X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 07:11:32 -0000 SGkgUm9sYW5kLA0KSSB0ZW5kIHRvIGFncmVlIHRoaXMgd29yayBpcyBhbiBpbXBvcnRhbnQgcGFy dCBvZiB0aGUgd2hvbGUgbWlncmF0aW9uIGNoYWluLiBCdXQgSSBhbSBub3Qgc3VyZSB3aGVyZSB0 aGlzIGNvbmZpZ3VyYXRpb24gcmVsYXRlZCB3b3JrIHNob3VsZCBiZSBkb25lOiBET1RTIG9yIEky TlNGPw0KDQpCLlINCkZyYW5rDQoNCi0tLS0t08q8/tStvP4tLS0tLQ0Kt6K8/sjLOiBEb3RzIFtt YWlsdG86ZG90cy1ib3VuY2VzQGlldGYub3JnXSC0+rHtIFJvbGFuZCBEb2JiaW5zDQq3osvNyrG8 5DogMjAxNcTqN9TCM8jVIDIxOjM4DQrK1bz+yMs6IGRvdHNAaWV0Zi5vcmcNCrOty806IFRpcnVt YWxlc3dhciBSZWRkeSAodGlyZWRkeSkNCtb3zOI6IFJlOiBbRG90c10gTmV3IFZlcnNpb24gTm90 aWZpY2F0aW9uIGZvciBkcmFmdC1yZWRkeS1kb3RzLXRyYW5zcG9ydC0wMC50eHQNCg0KDQpPbiAx IEp1bCAyMDE1LCBhdCAwOjM1LCBTY290dCBCYXJ2aWNrIHdyb3RlOg0KDQo+IEknZCBlbmNvdXJh Z2UgeW91IHRvIGpvaW4gdGhlIERPVFMgZWZmb3J0cyBhbmQgaGVscCBtYWtlIERPVFMgc3VwcG9y dCANCj4gdGhpcyB1c2UgY2FzZSBhcyB3ZWxsIGFzIHRoZSBvdGhlciB1c2UgY2FzZXMgdGhhdCB3 ZSBhcmUgZGV2ZWxvcGluZy4NCg0KQ29uY3VyLiAgVGhpcyBpcyBhIGdvb2QgYXJjaGl0ZWN0dXJh bCBhbmQgb3BlcmF0aW9uYWwgbW9kZWwgb2YgdGhlIG1lY2hhbmljcyBvZiBERG9TIG1pdGlnYXRp b24gd2hpY2ggd291bGQgYmUgdGhlIHVsdGltYXRlIG91dHB1dCBvZiBET1RTIHNpZ25hbGluZyBm cm9tIGFuIG9yZ2FuaXphdGlvbiB1bmRlciBhdHRhY2sgdG8gYW4gb3JnYW5pemF0aW9uIHBlcmZv cm1pbmcgRERvUyBtaXRpZ2F0aW9uIGZvciB0aGUgdGFyZ2V0ZWQgb3JnYW5pemF0aW9uLg0KDQpJ ZiB3ZSBjYW4gdXBkYXRlIHRoaXMgdG8gaW5jbHVkZSB0aGUgaW5pdGlhbCBzaWduYWxpbmcgZnJv bSB0aGUgdGFyZ2V0ZWQgb3JnYW5pemF0aW9uIHRvIHRoZSBtaXRpZ2F0aW9uIG9yZ2FuaXphdGlv biAtIGkuZS4sIHRoZSBwb3J0aW9uIG9mIHRoZSBtaXRpZ2F0aW9uIGNoYWluIHdoaWNoIGlzIHRo ZSBtYW5kYXRlIG9mIHRoaXMgV0cgLSBJIHRoaW5rIHRoaXMgY291bGQgcHJvdmUgYW4gZXhjZWxs ZW50IGV4YW1wbGUgb2YgaG93IERPVFMgZml0cyBpbnRvIHRoYXQgbWl0aWdhdGlvbiBjaGFpbi4N Cg0KVGhlcmUncyBubyByZXF1aXJlbWVudCBmb3IgYSBET1RTIHN1cHBsaWNhbnQgbm9kZSB0byBo YXZlIGFueSBvcmdhbmljIGRldGVjdGlvbi9jbGFzc2lmaWNhdGlvbi90cmFjZWJhY2sgbWVjaGFu aXNtOyBpZiBhIHN1cHBsaWNhbnQgaGFzIHRoYXQgY2FwYWJpbGl0eSwgdGhhdCdzIHBvdGVudGlh bGx5IHVzZWZ1bCwgYnV0IG91ciBpbml0aWFsIGZvY3VzIHdpdGggdGhlIGZpcnN0IHBoYXNlIG9m IHRoaXMgZWZmb3J0IGlzIHNpbXBseSB0byBzdGFuZGFyZGl6ZSB1cG9uIGEgcHJvdG9jb2wgd2hp Y2ggYWxsb3dzIGVpdGhlciBhdXRvbWF0ZWQgb3IgbWFudWFsbHktdHJpZ2dlcmVkIG1pdGlnYXRp b24gcmVxdWVzdHMgdG8gYmUgc2lnbmFsZWQgZWl0aGVyIGludGVyLSBvciBpbnRyYS1vcmdhbml6 YXRpb25hbGx5IGluIG9yZGVyIHRvIHJlcXVlc3QgdGhhdCBERG9TIG1pdGlnYXRpb24gYWN0aXZp dGllcyBiZSBpbml0aWF0ZWQgb24gYW4gb24tZGVtYW5kIGJhc2lzLCBhbmQgd2hpY2ggYWxzbyBh bGxvd3MgZm9yIHVzZWZ1bCBmZWVkYmFjayByZWdhcmRpbmcgdGhlIGVmZmljYWN5IGFuZCBzdGF0 dXMgb2Ygc2FpZCBtaXRpZ2F0aW9uIGFjdGl2aXRpZXMgdG8gYmUgc2lnbmFsZWQgYmFjayB0byB0 aGUgcmVxdWVzdG9yLiAgSXQgc2hvdWxkIGJlIGRlc2lnbmVkIHNvIHRoYXQgaXQgY2FuIGVhc2ls eSBiZSBleHRlbmRlZCB0byBpbmNvcnBvcmF0ZSBvdGhlciBkZXNpcmVkIGZ1bmN0aW9uYWxpdHkg aW4gZnV0dXJlIHBoYXNlcyBvZiBkZXZlbG9wbWVudC4NCg0KVmVyeSBzcGVjaWZpY2FsbHksIHRo aXMgc3RhdGVtZW50Og0KDQogICAgRW50ZXJwcmlzZXMgdHlwaWNhbGx5IGRlcGxveSBERG9TIG1v bml0b3JpbmcgYXBwbGlhbmNlcyB0aGF0IGFyZQ0KICAgIGNhcGFibGUgb2YgaW5zcGVjdGluZyBh bmQgbW9uaXRvcmluZyB0cmFmZmljIHRvIGRldGVjdCBwb3RlbnRpYWwgRERvUw0KICAgIHRocmVh dHMgYW5kIGdlbmVyYXRlIGFsYXJtcyB3aGVuIHNvbWUgdGhyZXNob2xkcyBoYXZlIGJlZW4gcmVh Y2hlZC4NCg0Kd2hpbGUgcmVmbGVjdGluZyBhIHZlcnkgZGVzaXJhYmxlIHN0YXRlIG9mIGFmZmFp cnMsIGlzIHNvbWV3aGF0IGFzcGlyYXRpb25hbCBpbiBuYXR1cmUsIGF0IHRoaXMganVuY3R1cmUu ICBXaGlsZSBtb3JlIGFuZCBtb3JlIGVuZHBvaW50IG5ldHdvcmtzIGFyZSBiZWdpbm5pbmcgdG8g aW52ZXN0aWdhdGUgYW5kIGRlcGxveSBzeXN0ZW1zIHdoaWNoIHByb3ZpZGUgdGhlc2UgY2FwYWJp bGl0aWVzLCBpdCBpc24ndCB0aGUgbm9ybSwgdG9kYXkuICBPbmUgb2YgdGhlIHB1cnBvc2VzIG9m IHRoZSBET1RTIHNpZ25hbGluZyBlZmZvcnQgaXMgdG8gcHJvdmlkZSBvcmdhbml6YXRpb25zIHdo aWNoIGhhdmVuJ3QvY2FuJ3QgZGVwbG95IHRoZXNlIHR5cGVzIG9mIHN5c3RlbXMgd2l0aCBhIHNp Z25hbGluZyBtZWNoYW5pc20gdGhleSBjYW4gdXRpbGl6ZSB0byByZXF1ZXN0IEREb1MgbWl0aWdh dGlvbiBhc3Npc3RhbmNlIGFzIHJlcXVpcmVkLg0KDQoNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tDQpSb2xhbmQgRG9iYmlucyA8cmRvYmJpbnNAYXJib3IubmV0Pg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KRG90cyBtYWlsaW5n IGxpc3QNCkRvdHNAaWV0Zi5vcmcNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vZG90cw0K From nobody Mon Jul 6 01:30:31 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B364C1A90BC for ; Mon, 6 Jul 2015 01:30:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.789 X-Spam-Level: * X-Spam-Status: No, score=1.789 tagged_above=-999 required=5 tests=[BAYES_50=0.8, MSGID_MULTIPLE_AT=1, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1NnahgzXdgJy for ; Mon, 6 Jul 2015 01:30:27 -0700 (PDT) Received: from mail.jpshallow.com (mail.jpshallow.com [217.40.240.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BDEFE1A1B2B for ; Mon, 6 Jul 2015 01:30:27 -0700 (PDT) Received: from ip192-168-0-9.jpshallow.com ([192.168.0.9] helo=SHALLOW4) by mail.jpshallow.com with smtps (TLSv1:RC4-MD5:128) (Exim 4.72) (envelope-from ) id 1ZC1nF-0003Bb-W2 for ietf-supjps-dots@ietf.org; Mon, 06 Jul 2015 09:30:26 +0100 From: "Jon Shallow" To: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> In-Reply-To: <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> Date: Mon, 6 Jul 2015 09:30:58 +0100 Message-ID: <000901d0b7c6$165a03f0$430e0bd0$@shallow@jpshallow.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AdC3rcg22ZL+6a6FSUm2ruyeZ6r27gAEtsFA Content-Language: en-gb Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 08:30:29 -0000 > As always - comments and feedback are welcome Re using SCTP as an alternative protocol debate. I believe that we have lost focus on the boundary / extreme conditions caused by a DDoS attack - which need to be handled as this is why DOTS is in existence! Any connection orientated protocol - whether it is TCP, SCTP or anything else - that is totally dependent on the returning "ACK" which travels in the opposite direction to the main data flow, will fail / rate-limit / block etc if for any reason the "ACK" cannot get through. Thus any returning "pipe full" type scenario (as caused by a DDoS attack) to the "exporting process" will stop the ability of the "exporting process" to transmit anything to the "collecting process". Game over. UDP has its limitations, but only needs to transmit the IPFIX information in one direction, usually in the opposite direction to the DDoS attack. The "collecting process" can determine (through missing heartbeat packets etc.) that there is an issue at the "exporting process" end (or somewhere in between in the data path) and can take appropriate action if needed. Regards Jon PS The irony here is UDP is the reliable protocol, but we have all been taught that UDP is unreliable compared to TCP! From nobody Mon Jul 6 04:24:53 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50D011A8895 for ; Mon, 6 Jul 2015 04:24:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ejGFxrQZ4VLA for ; Mon, 6 Jul 2015 04:24:51 -0700 (PDT) Received: from atl4mhob15.myregisteredsite.com (atl4mhob15.myregisteredsite.com [209.17.115.53]) by ietfa.amsl.com (Postfix) with ESMTP id 77B021A0094 for ; Mon, 6 Jul 2015 04:24:51 -0700 (PDT) Received: from mailpod.hostingplatform.com ([10.30.71.207]) by atl4mhob15.myregisteredsite.com (8.14.4/8.14.4) with ESMTP id t66BOn3t012765 for ; Mon, 6 Jul 2015 07:24:49 -0400 Received: (qmail 29825 invoked by uid 0); 6 Jul 2015 11:24:49 -0000 X-TCPREMOTEIP: 24.160.185.15 X-Authenticated-UID: gclark@mti-systems.com Received: from unknown (HELO ?192.168.1.6?) (gclark@mti-systems.com@24.160.185.15) by 0 with ESMTPA; 6 Jul 2015 11:24:49 -0000 Message-ID: <559A6583.20405@mti-systems.com> Date: Mon, 06 Jul 2015 07:24:51 -0400 From: Gilbert Clark User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: dots@ietf.org References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 11:24:53 -0000 From section 6.3 of RFC 5153 ("IP Flow Information Export (IPFIX) Implementation Guidelines"): "TCP can be used as a transport protocol for IPFIX if one of the endpoints has no support for SCTP, but a reliable transport is needed and/or the network between the Exporter and the Collector has not explicitly been provisioned for the IPFIX traffic. TCP is one of the core protocols of the Internet and is widely supported." Would it make sense to adopt a similar position here? -Gilbert Clark On 7/5/2015 3:24 PM, Roland Dobbins wrote: > > On 6 Jul 2015, at 2:00, Teague, Nik wrote: > >> I’d like to hear everyone's further thoughts on the matter. > > It's pretty well-established that we need a stateful transport > alternative, per previous discussion on-list. Unfortunately, it's > also pretty well-established that we can't simply assume that SCTP > will make it through a given topological path and/or intervening > devices/services/policies, especially with regards to endpoint > networks, which is where the majority of DOTS supplicants will likely > reside. > > Though it pains me to say it, I simply don't think SCTP can seriously > be considered for this application, at least in the initial stages, > due to these significant operational concerns. While DOTS is an > extremely important initiative which will have a far-reaching positive > impact when brought to fruition, it isn't likely to be the 'killer > app' which brings SCTP adoption into the mainstream, either. > > Note that this hasn't anything to do with the availability of code, > example implementations, etc. - it's an unfortunate side-effect of the > network-policy-based overfiltering and lowest-common-denominator > protocol support in the installed base and default configurations, all > of which are constant banes to innovation in the Internet space. > > ----------------------------------- > Roland Dobbins > > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Mon Jul 6 06:27:57 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E8921A3B9D for ; Mon, 6 Jul 2015 06:27:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t9XvhW1atxCz for ; Mon, 6 Jul 2015 06:27:54 -0700 (PDT) Received: from mail-pa0-x22f.google.com (mail-pa0-x22f.google.com [IPv6:2607:f8b0:400e:c03::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D6F01A6F1E for ; Mon, 6 Jul 2015 06:27:54 -0700 (PDT) Received: by pacgz10 with SMTP id gz10so21895097pac.3 for ; Mon, 06 Jul 2015 06:27:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=u+a3Fxy8OEiilhGW3McxH94vJveEKexGc/apI79M+q8=; b=IcX6U72P0mV9qTupWVuALfIxAkKViq5x4RrerASjLijKuSazI1F1okAK3nT/u9OkxM HBjODe6lx2p2E5xMuBtZJsOP9LlqtS6ZrPOfD9MZPmdPK2aj6ATWGwZ5t1PlNu4ILJRk ggmMI3NxBuyq6xNFgsRfmDCzG1yWiP/2YR58A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=u+a3Fxy8OEiilhGW3McxH94vJveEKexGc/apI79M+q8=; b=Kn+IydzmQ15noenoulNKSwV1w9GEfyh7tmgIUQpySEr7ciE+XDJac0BA68jjxxNI2/ TZRSGTgrM0GDBZRog85Y4cCZARPx3x4OfD5Ox4kG2dsTsoeF20ew82ig1C2lG40UCJ3L aMkbeu/kwJwdsDXcEsKdcU8ktvr32Z2ryc2ZA76EpeLaW/5xU75d4yt6b7owVR6qB94m 5kBzXsi3satuvIdboKeGDAClXIFwvBKT4MoEp/T5Gh+BBoZWsCU0b59jPUiRxC1g5SeS 4tJHGfFHU+e5tS8eO+AyA5JuzgP+bIxvtozlLn7bRE+kFRK7oAy67kftNDa4QnYK6nfL HgDw== X-Gm-Message-State: ALoCoQlZKgQbywd1wxMWzoIVHmgK0Gg9sa5Kv+tlnm3haD4zvCJDdzM6+JmsDVfAIwQsSczYEJwX X-Received: by 10.70.124.134 with SMTP id mi6mr106193528pdb.104.1436189274198; Mon, 06 Jul 2015 06:27:54 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id bs3sm18308415pbd.47.2015.07.06.06.27.51 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 06:27:52 -0700 (PDT) From: "Roland Dobbins" To: dots@ietf.org Date: Mon, 06 Jul 2015 20:27:47 +0700 Message-ID: <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> In-Reply-To: <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 13:27:55 -0000 On 6 Jul 2015, at 15:30, Jon Shallow wrote: > I believe that we have lost focus on the boundary / extreme conditions > caused by a DDoS attack - which need to be handled as this is why DOTS > is in > existence! Not at all. The reason we need an alternative stateful transport was discussed on-list a few weeks ago. Suggest you read through the list archives. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 06:32:05 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59DE71A871F for ; Mon, 6 Jul 2015 06:32:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id di6Hog6dK98t for ; Mon, 6 Jul 2015 06:32:01 -0700 (PDT) Received: from mail-pd0-x236.google.com (mail-pd0-x236.google.com [IPv6:2607:f8b0:400e:c02::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E0441A6FEF for ; Mon, 6 Jul 2015 06:32:01 -0700 (PDT) Received: by pdbep18 with SMTP id ep18so106260497pdb.1 for ; Mon, 06 Jul 2015 06:32:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=de1m7XmeDiXZ+uIHc62UTT1WkmnLk8z8gCyYNKkmrmA=; b=kjmskSSyg/d1gsS8PZAo1rvT3RuNK7+8kLuQs1IkLXGnPRSPyiCz3cJs/4H1ENvs4z RcEWyG5b1X3W6nmWGLEdtuitfY55BXqo9o5Gww+xPeBnbe8hTBTMSh4xlXDw6ZRF4bs2 8u4LujPuQ2pLrIgrZAV/spVjfLqiDkTfZstnA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=de1m7XmeDiXZ+uIHc62UTT1WkmnLk8z8gCyYNKkmrmA=; b=DvXaOK3x2PwvMMs1Tjx7eCcDCQbSBaBkkRoHiAu4SY2ISA/oV3byVS3O/foBEFl3iI mEtj3bQWeMDjjJyaEhBENcHLUpovT4JaqSaqaDBQy0+XJsUgVpH9almKvdpxM//LiGPA uOxNSiohQVFUzvSTPuZ1RHU3iwz7rHCatbIsB00u6cXxgq9FGIGCqdyGTefozzK59M6V ltNU5BikHHqGyiELOzLrsUpFXhbihSTHEXWZjs561+ZpAwkxUG5dBPJNT3tYrdZUs2nP CUiJu6rLOGSyXzNO3+/UfeyM2NwtN/DR2poqERdm77U1QMzciuBI5v3Boxdck6xRjdR/ haBg== X-Gm-Message-State: ALoCoQnDo72jwplfBcuxE5aAuUnTyFxapS/ut2G3knpQFL9vfefnla55ygcXPyDw5aSsWnZkIw8t X-Received: by 10.68.228.168 with SMTP id sj8mr103978806pbc.102.1436189521048; Mon, 06 Jul 2015 06:32:01 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id do3sm18334567pbb.5.2015.07.06.06.31.57 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 06:31:59 -0700 (PDT) From: "Roland Dobbins" To: dots@ietf.org Date: Mon, 06 Jul 2015 20:31:54 +0700 Message-ID: In-Reply-To: <559A6583.20405@mti-systems.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <559A6583.20405@mti-systems.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 13:32:04 -0000 On 6 Jul 2015, at 18:24, Gilbert Clark wrote: > Would it make sense to adopt a similar position here? Yes, IMHO, keeping in mind that we should keep to general principles for now, as we're at the beginning of the requirements-definition has. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 06:38:29 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D52F1A8759 for ; Mon, 6 Jul 2015 06:38:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Ro2H5DlOXdp for ; Mon, 6 Jul 2015 06:38:27 -0700 (PDT) Received: from mail-pd0-x232.google.com (mail-pd0-x232.google.com [IPv6:2607:f8b0:400e:c02::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 593BF1A872F for ; Mon, 6 Jul 2015 06:38:27 -0700 (PDT) Received: by pdbdz6 with SMTP id dz6so11115307pdb.0 for ; Mon, 06 Jul 2015 06:38:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=YcbnBOW8EJ6Yy6RqXKn+dGBfRFVEE+m5/seqNRb9OJI=; b=ji8zh+GaVTGEyAEsv6cij6kLE7W1zgg0mrGICOe5kbjyefiDWI9OkyM8UlrNj5nM1B W9+rlMVrNhqDtUc9cc7CJDTTf28yROxBqvhfqgd2gy56y4eNmOaVSxDPaVUWt4HZs052 CdrIHjhU0pUa16M3ZXz34Mumea8MRh4l8YA+k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=YcbnBOW8EJ6Yy6RqXKn+dGBfRFVEE+m5/seqNRb9OJI=; b=M5HNE98dSIzGK+fN9dFR3e3/xuGwbAHLSFovONNWmUeOutrSebK6+xjhFxCOxZqsI6 rjAq5NtGRFpO/B7M+neAB/1shHjT7Q0Hk1hQzYD0mVycSRiGuVBlGRu1BOPlrD2BcwV+ VcFHKwzL5KI2vVBIgzvIJqtoxUHcSD/ZVB/4GXGWV4xO5PfYFqKxBAEkTGvmNpdUtOzr yRjOJCv83heK6O2XQebLMXCvDzJBcz/Zldm8F6nw4O12Gcmq1cPCHbzr0fJvKrT62wNI NlpiDXHXamEMnd1SYra6hZ0nyL+qljL24yoAXJRKLNDYmClxt65gI+iVPuTbtJj40waE T8PQ== X-Gm-Message-State: ALoCoQn08szyPcYO6RCyVePoLXjdL26rcU9SMhGZ0B5QUPJudJ+89iwN9t9N4m2zM6ZKDUXZH2Kn X-Received: by 10.68.93.229 with SMTP id cx5mr79060780pbb.104.1436189907048; Mon, 06 Jul 2015 06:38:27 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id pz9sm18324245pbb.93.2015.07.06.06.38.24 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 06:38:25 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 20:38:21 +0700 Message-ID: <83901B12-3B0D-4EDB-BE06-AA1F6B61DFC1@arbor.net> In-Reply-To: References: <20150630020939.10497.81039.idtracker@ietfa.amsl.com> <913383AAA69FF945B8F946018B75898A478809EC@xmb-rcd-x10.cisco.com> <6073823821667642A5C884FF3A8807F81F499763@MERCURY.corero.com> <709D967A-C7A7-4171-837D-BD57AED85701@arbor.net> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-reddy-dots-transport-00.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 13:38:28 -0000 On 6 Jul 2015, at 14:11, Xialiang (Frank) wrote: > But I am not sure where this configuration related work should be > done: DOTS or I2NSF? At the appropriate juncture, it will be necessary to provide architectural and functional examples to guide implementors and operators. And as you note, it will also be necessary to make scoping determinations with regards to potentially complementary efforts such as I2NSF. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 06:57:42 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 698CC1A8826 for ; Mon, 6 Jul 2015 06:57:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.911 X-Spam-Level: X-Spam-Status: No, score=-0.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MSGID_MULTIPLE_AT=1, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AfKoOS89olCq for ; Mon, 6 Jul 2015 06:57:40 -0700 (PDT) Received: from mail.jpshallow.com (mail.jpshallow.com [217.40.240.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 750C51A8798 for ; Mon, 6 Jul 2015 06:57:40 -0700 (PDT) Received: from ip192-168-0-9.jpshallow.com ([192.168.0.9] helo=SHALLOW4) by mail.jpshallow.com with smtps (TLSv1:RC4-MD5:128) (Exim 4.72) (envelope-from ) id 1ZC6tu-0003RQ-VW for ietf-supjps-dots@ietf.org; Mon, 06 Jul 2015 14:57:39 +0100 From: "Jon Shallow" To: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> In-Reply-To: <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> Date: Mon, 6 Jul 2015 14:57:58 +0100 Message-ID: <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AdC375pyiL1mktkrRnuB3C/awKfRXQAAoTxQ Content-Language: en-gb Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 13:57:41 -0000 > The reason we need an alternative stateful transport was discussed on-list a few weeks ago. Suggest you read through the list archives. Sure - I had already read the information you refer to circa 11th June, but did not have time to respond then. The issues with Stateful firewall / NAT / ACLs etc for UDP almost completely disappear if you look at a uni-directional UDP flow containing the IPFIX signalling information - but agreed issues are problematic for bi-directional UDP flow. All that really needs to be considered is the security of the information held within the UDP flow - wrapping it in a IPSEC tunnel or similar we go back to the "ACK" response failing to get back issue when keys have to be re-negotiated. Regards Jon From nobody Mon Jul 6 07:09:13 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F04861A87E9 for ; Mon, 6 Jul 2015 07:09:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wwKyulD5EKVw for ; Mon, 6 Jul 2015 07:09:10 -0700 (PDT) Received: from mail-pa0-x234.google.com (mail-pa0-x234.google.com [IPv6:2607:f8b0:400e:c03::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 919191A87BC for ; Mon, 6 Jul 2015 07:09:10 -0700 (PDT) Received: by pabvl15 with SMTP id vl15so96233077pab.1 for ; Mon, 06 Jul 2015 07:09:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=oP3Q+IUYgD7lbv+CtZeH1aGoXJp5Gy6W9/ZmeRYWSxY=; b=Co6qz2lR2iH9P7bi+8AumDKwBQMg+KZ29jsvCr5o+N9ZXyWJ7WlCYcYZxqW0wxoooY 8wlfUJOf2Z3U5ihLtPsQaxfOKS8Ak9+tIsFKeefVIO/wR45uTxLXacN+HfDyhYtV5t8T ylKZ/PZAlyGb2CUSYCU5qYgVyuj91QSa9cvLg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=oP3Q+IUYgD7lbv+CtZeH1aGoXJp5Gy6W9/ZmeRYWSxY=; b=Wc5G6p6m1sH3BnjvARe8QtA60yGVOGtfjn9DS4EI+8Zu7WrI7gNvNvjCx6cMzjk0KF keUilfVrIbIsN1y95bHyUCu/DsYW/EfiMq+/Rnj4BdcozBI8SbJdhbO2s/r+Y0bLQTA1 SXUlpnsEirra28/zRw6N2L+uN4HnhMhX83pX6NlHfr2/ygkd8yJ/AyLIvxjUa+ns17YK mQoABW+IS7J7uN0VnTA1mvKaE58n0iWnDOsv+gpScHtfAFIj4oYYKDovzoJJUTEGhvnP K4LgF/EAZCSjJrjVB0xpr34WM1kbcZLW5vA+V77byBonWomsBIgiIM7AHZP4J5yk2NCr Hu/g== X-Gm-Message-State: ALoCoQmWCht0ETpYSAj0mioH4198DOeNMbXGW09rS58mrwmwgUC38D2+Wr7r4VoFfgDocYE3j0X9 X-Received: by 10.66.190.228 with SMTP id gt4mr106372364pac.72.1436191750213; Mon, 06 Jul 2015 07:09:10 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id og1sm1745545pdb.58.2015.07.06.07.09.07 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 07:09:08 -0700 (PDT) From: "Roland Dobbins" To: dots@ietf.org Date: Mon, 06 Jul 2015 21:09:04 +0700 Message-ID: <7108561F-AC51-47D6-BAAD-5AFB4E701999@arbor.net> In-Reply-To: <559a8958.c27e460a.4b06.ffffa358SMTPIN_ADDED_BROKEN@mx.google.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <559a8958.c27e460a.4b06.ffffa358SMTPIN_ADDED_BROKEN@mx.google.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:09:12 -0000 On 6 Jul 2015, at 20:57, Jon Shallow wrote: > The issues with Stateful firewall / NAT / ACLs etc for UDP almost > completely > disappear if you look at a uni-directional UDP flow containing the > IPFIX > signalling information - but agreed issues are problematic for > bi-directional UDP flow. Actually, it's also a problem for unidirectional communications due to overfiltering and overly-restrictive traffic-transformation configurations/policies which is all-too-commonly encountered on endpoint networks, whether said communications are southbound - northbound, northbound - southbound, or eastbound-westbound (all of which are relevant to DOTS). In order for DOTS to succeed, we must take into account lowest-common-denominator, overly-restrictive communications channels, often the result of network access policy arteriosclerosis, operational/architectural entropy, and overenthusiasm. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 07:09:53 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 269C31A87E9 for ; Mon, 6 Jul 2015 07:09:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Wa3hSMfBJ9K for ; Mon, 6 Jul 2015 07:09:50 -0700 (PDT) Received: from mail1.bemta12.messagelabs.com (mail1.bemta12.messagelabs.com [216.82.251.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 458B71A21B5 for ; Mon, 6 Jul 2015 07:09:50 -0700 (PDT) Received: from [216.82.250.19] by server-16.bemta-12.messagelabs.com id A9/FB-32232-D2C8A955; Mon, 06 Jul 2015 14:09:49 +0000 X-Env-Sender: Scott.Barvick@corero.com X-Msg-Ref: server-12.tower-87.messagelabs.com!1436191788!23171037!1 X-Originating-IP: [71.184.227.49] X-StarScan-Received: X-StarScan-Version: 6.13.16; banners=-,-,- X-VirusChecked: Checked Received: (qmail 9434 invoked from network); 6 Jul 2015 14:09:49 -0000 Received: from mercury.corero.com (HELO MERCURY.corero.com) (71.184.227.49) by server-12.tower-87.messagelabs.com with AES128-SHA encrypted SMTP; 6 Jul 2015 14:09:49 -0000 Received: from MERCURY.corero.com ([fe80::2c05:6b26:abe2:ad24]) by MERCURY.corero.com ([fe80::2c05:6b26:abe2:ad24%19]) with mapi id 14.03.0235.001; Mon, 6 Jul 2015 10:09:48 -0400 From: Scott Barvick To: Jon Shallow , "dots@ietf.org" Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuAgACXawCAAK+HAIAAB4+AgAAeL4CAAECi34AAS14A//+97OA= Date: Mon, 6 Jul 2015 14:09:47 +0000 Message-ID: <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> In-Reply-To: <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.20.30.22] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:09:52 -0000 And one general principle that we cannot forget is that the supplicant or t= he link to it may be under a significant attack when we need all of the mec= hanisms to work. IMO, the one way, outbound telemetry traffic (e.g IPFIX) is the easy part. = The telemetry information can be/will be resent periodically and there w= ill be a good chance one can get out. The signaling channel that sends the value-added information, up to and inc= luding of course, the 'signal' is the harder problem. It has more semantic= s associated with it so the requirements across the board will be more stri= ngent, but the obvious choices for transports may not perform reliably unde= r a heavy inbound attack. Scott -----Original Message----- From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Jon Shallow Sent: Monday, July 06, 2015 9:58 AM To: dots@ietf.org Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-s= ignaling-01.txt > The reason we need an alternative stateful transport was discussed=20 > on-list a few weeks ago. Suggest you read through the list archives. Sure - I had already read the information you refer to circa 11th June, but= did not have time to respond then. The issues with Stateful firewall / NAT / ACLs etc for UDP almost completel= y disappear if you look at a uni-directional UDP flow containing the IPFIX = signalling information - but agreed issues are problematic for bi-direction= al UDP flow. All that really needs to be considered is the security of the information h= eld within the UDP flow - wrapping it in a IPSEC tunnel or similar we go ba= ck to the "ACK" response failing to get back issue when keys have to be re-= negotiated. Regards Jon _______________________________________________ Dots mailing list Dots@ietf.org https://www.ietf.org/mailman/listinfo/dots From nobody Mon Jul 6 07:12:29 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 550BE1A8896 for ; Mon, 6 Jul 2015 07:12:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MnpDLP5h6_ir for ; Mon, 6 Jul 2015 07:12:27 -0700 (PDT) Received: from mail-pd0-x22a.google.com (mail-pd0-x22a.google.com [IPv6:2607:f8b0:400e:c02::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3F131A1A73 for ; Mon, 6 Jul 2015 07:12:23 -0700 (PDT) Received: by pdbdz6 with SMTP id dz6so11572527pdb.0 for ; Mon, 06 Jul 2015 07:12:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=zANgD0kWvklRBlXSCl8RSpsh5vazFHyUSOQJqE9LALI=; b=HPCZpU2hN3wPqu2chV7izj7+VhSp8FLEyWXMueOceXcg1WaMcreu5gOCJeml5Ph8o/ 3XNoOivtcjmG5OOack4YYiBXHVNcfhINvbhvJZlDG6VWBjnd3R8AtmPB7C4iHqVXyJM3 HGvlDh2UmEf89kRnIXACP8dbaxUfDE6oljHl4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=zANgD0kWvklRBlXSCl8RSpsh5vazFHyUSOQJqE9LALI=; b=eFDlhuzOJ6/lKHLcRBEE477jTEGrCEh/0yqkHr28g5CM4caBkMNipr5O7dai+DCgC8 RGIKoW/23ok/8jOB4BPaEGC5n11BppL9Kccw5/h5I/u2GUuKAAhpbsRdnlebKtQSxYQD tI2msyRtIcYMzIdHyD+KWotpFPz0lkNX1Fso0gwAmTweFlggInW6300wnbLr/noKD/Je Sksap1vK+08JUN4QJz/08aT2lEfKaM7qSE6h/8i3aJBYmUybVU83eIMPrnYxMBISeshJ n3U3qYCDKYRmtVyH0qIz5HK6qFET5a5jkR17USu+V7yy0hRbnMDj+ng5C3wOoFyVhA0o /0Dw== X-Gm-Message-State: ALoCoQkqiLJ1WuPZt/Ea4zG9oPOqIU2PQL+88R+MhItgQZ2E67ZQ6lTqTwxeA+3y/mHjLC+FHjsG X-Received: by 10.67.29.175 with SMTP id jx15mr104861331pad.99.1436191943474; Mon, 06 Jul 2015 07:12:23 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id o7sm18478417pdi.16.2015.07.06.07.12.20 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 07:12:22 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 21:12:17 +0700 Message-ID: <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> In-Reply-To: <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:12:28 -0000 On 6 Jul 2015, at 21:09, Scott Barvick wrote: > And one general principle that we cannot forget is that the supplicant > or the link to it may be under a significant attack when we need all > of the mechanisms to work. > > IMO, the one way, outbound telemetry traffic (e.g IPFIX) is the easy > part. The telemetry information can be/will be resent periodically > and there will be a good chance one can get out. > > The signaling channel that sends the value-added information, up to > and including of course, the 'signal' is the harder problem. It has > more semantics associated with it so the requirements across the board > will be more stringent, but the obvious choices for transports may not > perform reliably under a heavy inbound attack. Concur 100%. Also, the notions of mutual authentication and privacy protections are applicable, here. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 07:21:33 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 181491A886D for ; Mon, 6 Jul 2015 07:21:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Zw7s2MsLOAb for ; Mon, 6 Jul 2015 07:21:14 -0700 (PDT) Received: from prod-mail-xrelay08.akamai.com (prod-mail-xrelay08.akamai.com [96.6.114.112]) by ietfa.amsl.com (Postfix) with ESMTP id B0B4E1A884C for ; Mon, 6 Jul 2015 07:21:13 -0700 (PDT) Received: from prod-mail-xrelay08.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 3BAC64CB74; Mon, 6 Jul 2015 14:21:13 +0000 (GMT) Received: from prod-mail-relay08.akamai.com (prod-mail-relay08.akamai.com [172.27.22.71]) by prod-mail-xrelay08.akamai.com (Postfix) with ESMTP id 22D604CB63; Mon, 6 Jul 2015 14:21:13 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=akamai.com; s=a1; t=1436192473; bh=bdE2UasNQ7lkvOb+VN1HQY7e6wx7gfBN0VRCU/fTiAg=; h=From:To:Subject:Date:References:In-Reply-To:From; b=zz97nuelPu6Fh8r4lv1EbNza0MybDvrOhyoufrc3t/h/rmdjw4Bk86FvlFwQ1jhrY NgwETwto8Bijs76lh0wALhSWYjq9Yk6XxLvbYFs1DmtL7Tz65jSc7czPTUgquT1vFW j2SIE0z5ttztgTG/6ofMe2hG+CQxd95CjFg98z5U= Received: from email.msg.corp.akamai.com (ustx2ex-cas1.msg.corp.akamai.com [172.27.25.30]) by prod-mail-relay08.akamai.com (Postfix) with ESMTP id 20B3D9803E; Mon, 6 Jul 2015 14:21:13 +0000 (GMT) Received: from USTX2EX-DAG1MB2.msg.corp.akamai.com (172.27.27.102) by ustx2ex-dag1mb3.msg.corp.akamai.com (172.27.27.103) with Microsoft SMTP Server (TLS) id 15.0.1076.9; Mon, 6 Jul 2015 09:21:12 -0500 Received: from USTX2EX-DAG1MB2.msg.corp.akamai.com ([172.27.6.132]) by ustx2ex-dag1mb2.msg.corp.akamai.com ([172.27.6.132]) with mapi id 15.00.1076.000; Mon, 6 Jul 2015 09:21:12 -0500 From: "Salz, Rich" To: Jon Shallow , "dots@ietf.org" Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuAgACoLwCAAK+HAP//svEwgAByzICAAC/d4oAAXCQA//+yZwA= Date: Mon, 6 Jul 2015 14:21:12 +0000 Message-ID: <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> In-Reply-To: <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.45.106] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:21:22 -0000 Another thing to consider is the just-starting SPUD work, which takes as on= e of its primary justifications that SCTP has failed to get widespread adop= tion. If TCP/TLS isn't sufficient, then perhaps given the likely timetables, wait= ing for SPUD is a reasonable fallback. From nobody Mon Jul 6 07:34:36 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E522C1A88C4 for ; Mon, 6 Jul 2015 07:34:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IxmTvLW_Q6Mx for ; Mon, 6 Jul 2015 07:34:33 -0700 (PDT) Received: from mail-pd0-x232.google.com (mail-pd0-x232.google.com [IPv6:2607:f8b0:400e:c02::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FD051A87DB for ; Mon, 6 Jul 2015 07:34:27 -0700 (PDT) Received: by pdbci14 with SMTP id ci14so107063172pdb.2 for ; Mon, 06 Jul 2015 07:34:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=8P7bSrE8uZLIZWKZq+PG4KguVqmmJTY+iLFmtpniXT4=; b=XRyJ4rw9DZxfHfekYGIpct8UiRFfpsKr32gfC823idABmyAmI+nX70QVotPf+xr9y2 5r0MQuU2vDxPRu6uT5zHN1Z+ZzFkuKKoGKipcB+nmuP0ufj6YfEV0Asvr6M9GChZJRn1 CLhEhAH/Z1Bor2i+ioPgyMA7PHcHP3Tq36EJs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=8P7bSrE8uZLIZWKZq+PG4KguVqmmJTY+iLFmtpniXT4=; b=Tn2fCV1y/ts17gdsx35Oz99o68nzmv/wzz4oU6g9lhtqU1GhiTalfzQfyUueCcW6nL RaDfldTIn+i/yjmGFFI5QYx3NRPsihEks+ijmvaOtoRtivbOIcy21Fjvmahm9CWkaEpL ORCCUj4zLuPdGRA2Az8sk7juy7iqN0/ovRNy85gbVdtiSqD17s5wd4pycKyyaliSMBmy dMZB2uk38y5B5Db+htNrlW+8df/RhD3sIEm0OsUNLXQ1AqQCD8ZrjAldNcN2zj79qgCs NgQ+J1NoAChrggsxTn8VqeursjzCqkD0SKgyuKiTsQ15xxE3EGiyTq9sqIy7nf3QbwVV RpKA== X-Gm-Message-State: ALoCoQkuDsvLV/Iued0Yp7GlIm3u6sokPYh9Cf3fShzaiUr1RZqpshbjdp0iiJGWNWHRkFqoNqfW X-Received: by 10.68.240.40 with SMTP id vx8mr106165706pbc.14.1436193267174; Mon, 06 Jul 2015 07:34:27 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id j2sm18535995pdk.21.2015.07.06.07.34.24 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 07:34:25 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 21:34:21 +0700 Message-ID: In-Reply-To: <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:34:35 -0000 On 6 Jul 2015, at 21:21, Salz, Rich wrote: > If TCP/TLS isn't sufficient, then perhaps given the likely timetables, > waiting for SPUD is a reasonable fallback. There are certainly potential benefits to this approach; however, there is a longstanding significant unfulfilled need in the operational community for a standardized signaling mechanism for initiating and reporting on the status and outcome of DDoS mitigation efforts. It is also important to note that it is expected that DOTS will evolve over time in order to add new capabilities and to improve with regards to its various aspects and functionalities. And while there are always pros and cons of any given approach to be weighed, we mustn't make the perfect the enemy of the merely good, or we won't get something usable in the hands of operators within a reasonable timeframe. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 07:42:32 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35C831B2A57 for ; Mon, 6 Jul 2015 07:42:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LuhsnP1e6OqF for ; Mon, 6 Jul 2015 07:42:20 -0700 (PDT) Received: from prod-mail-xrelay02.akamai.com (prod-mail-xrelay02.akamai.com [72.246.2.14]) by ietfa.amsl.com (Postfix) with ESMTP id CF5111A88D8 for ; Mon, 6 Jul 2015 07:42:20 -0700 (PDT) Received: from prod-mail-xrelay02.akamai.com (localhost [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 1569628D1F; Mon, 6 Jul 2015 14:42:20 +0000 (GMT) Received: from prod-mail-relay06.akamai.com (prod-mail-relay06.akamai.com [172.17.120.126]) by prod-mail-xrelay02.akamai.com (Postfix) with ESMTP id EBB8C28D1E; Mon, 6 Jul 2015 14:42:19 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=akamai.com; s=a1; t=1436193739; bh=HW1CizM6qpt/Sx+znzlfF0a6Z3crDr0RRjTK3FBs274=; h=From:To:Subject:Date:References:In-Reply-To:From; b=XlCrJd4iKZcwX220jVtDctdpd6WCheXJOy7ec7jmJAZu9Hh7g8FROH7Geln1OP8h0 QIzJOTWvIgUh35eEnqG2FdHGUO3en7ArXbWBogkrxYrUBULPrVtorPOwIbwopvFurq zU3wbn+O9BtB6IyTAth83Hzt1pplNGIpWw9dgixE= Received: from email.msg.corp.akamai.com (ustx2ex-cas1.msg.corp.akamai.com [172.27.25.30]) by prod-mail-relay06.akamai.com (Postfix) with ESMTP id D3F692032; Mon, 6 Jul 2015 14:42:19 +0000 (GMT) Received: from USTX2EX-DAG1MB2.msg.corp.akamai.com (172.27.27.102) by ustx2ex-dag1mb1.msg.corp.akamai.com (172.27.27.101) with Microsoft SMTP Server (TLS) id 15.0.1076.9; Mon, 6 Jul 2015 09:42:19 -0500 Received: from USTX2EX-DAG1MB2.msg.corp.akamai.com ([172.27.6.132]) by ustx2ex-dag1mb2.msg.corp.akamai.com ([172.27.6.132]) with mapi id 15.00.1076.000; Mon, 6 Jul 2015 09:42:19 -0500 From: "Salz, Rich" To: Roland Dobbins , "dots@ietf.org" Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuAgACoLwCAAK+HAP//svEwgAByzICAAC/d4oAAXCQA//+yZwCAAFfDgP//rgWg Date: Mon, 6 Jul 2015 14:42:18 +0000 Message-ID: <10e47829935f4105893c893ab1c92d1f@ustx2ex-dag1mb2.msg.corp.akamai.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.45.106] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:42:29 -0000 > And while there are always pros and cons of any given approach to be > weighed, we mustn't make the perfect the enemy of the merely good, or we > won't get something usable in the hands of operators within a reasonable > timeframe. The question is whether the existing widely deployed protocols are good eno= ugh, or whether adding one that isn't widely deployed is a net positive or = not, right? From nobody Mon Jul 6 07:57:56 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA14E1A8932 for ; Mon, 6 Jul 2015 07:57:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqfD3PPWGQJz for ; Mon, 6 Jul 2015 07:57:50 -0700 (PDT) Received: from mail-ie0-f171.google.com (mail-ie0-f171.google.com [209.85.223.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53A0E1A896E for ; Mon, 6 Jul 2015 07:57:38 -0700 (PDT) Received: by ieqy10 with SMTP id y10so115224778ieq.0 for ; Mon, 06 Jul 2015 07:57:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=Tob/Zw/ilb+XDN4uSfjXikgi2gePkTZdNq7exJC7usY=; b=OPPuGUcBTDcawjk/sJWmtmgiAVDNRsl3MB7nIlyo/3JLDSYVQxYeMajbSyeCISX2Kq y/aWA+BY/sGyY4kY5fopxjsaST9xgz/hZRTpkIkUM75KSehK5R5JtnAc2g50P7ZkEed2 4jkBFohMP0EhRPlRdfH1W08LLlsszNZP0NvUtvpBj1QQ92+n/gzL8HgiSkOtm3yuLBzQ lLq8q5YixWqhl/OrWsi2nAI5ddDd4HtkJjwQ+2sSXyDkwAd1mgE+82wMRQN8PQMvVos8 ZSuhASjS/+WXUOjGuK9XxC0n0/Cb2lodtRs/6ECqXVogCEMK+PLdadFNv+062b2RxQqm aQ3Q== X-Gm-Message-State: ALoCoQk0rghiuBrb8kanOis0fqXUN8x0VMUKD14GrPBBe0PBYlNmGrJWvAa0pKm/OIuikfEBgqpV X-Received: by 10.107.10.231 with SMTP id 100mr6058214iok.41.1436194657804; Mon, 06 Jul 2015 07:57:37 -0700 (PDT) Received: from [205.169.63.165] ([205.169.63.165]) by mx.google.com with ESMTPSA id g12sm12594754ioe.28.2015.07.06.07.57.36 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Jul 2015 07:57:36 -0700 (PDT) Message-ID: <559A9757.5070904@flowtools.net> Date: Mon, 06 Jul 2015 08:57:27 -0600 From: John Schiel User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: dots@ietf.org References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> <10e47829935f4105893c893ab1c92d1f@ustx2ex-dag1mb2.msg.corp.akamai.com> In-Reply-To: <10e47829935f4105893c893ab1c92d1f@ustx2ex-dag1mb2.msg.corp.akamai.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:57:54 -0000 On 07/06/2015 08:42 AM, Salz, Rich wrote: >> And while there are always pros and cons of any given approach to be >> weighed, we mustn't make the perfect the enemy of the merely good, or we >> won't get something usable in the hands of operators within a reasonable >> timeframe. > The question is whether the existing widely deployed protocols are good enough, or whether adding one that isn't widely deployed is a net positive or not, right? In order to get this WG moving forward, we need to use existing, established communication protocols. I'm not saying SPUD is an inferior protocol but to get DOTS WG implemented sooner, we should not wait for an as yet undefined,un-chartered protocol. As Roland stated, "It is also important to note that it is expected that DOTS will evolve over time in order to add new capabilities and to improve with regards to its various aspects and functionalities." Once DOTS is implemented and once SPUD is defined, it may later be determined SPUD may be a useful protocol. --John Schiel > > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Mon Jul 6 07:59:41 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEC3E1A894B for ; Mon, 6 Jul 2015 07:59:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2-BlAjbLV8lG for ; Mon, 6 Jul 2015 07:59:37 -0700 (PDT) Received: from mail-pa0-x22a.google.com (mail-pa0-x22a.google.com [IPv6:2607:f8b0:400e:c03::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 369241A891A for ; Mon, 6 Jul 2015 07:59:36 -0700 (PDT) Received: by pacgz10 with SMTP id gz10so22989918pac.3 for ; Mon, 06 Jul 2015 07:59:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=zbIk8DRItFTMz+O5PW17n2cM+ZfRSGCxwitWsmNvMms=; b=GKnTEJmXA9w1zBWjDuvZeS3RGj/LNoNqlNaKIvI95NxIv2RdcHjoa9y1DmnBaqxbDv SNJSOvFmDcpFaWOHZx+EA95wf3ZIoJKzMXtH7KlUR59ptlrwXlBvAw6rl9Lj+jLHA00j fPr0j9l7hCgugUrmAfJjCPhTK63MKWO8m0a44= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=zbIk8DRItFTMz+O5PW17n2cM+ZfRSGCxwitWsmNvMms=; b=Dul1vksNq4Cj3mAklqHaga+RTLwag9KW0UVXUY14h+Fd7zIXdprsfFT7/HxEM4qH6W jPGuu7Bap5v2vkxrK74zq7jjT1EKTsOUBJuHsCXDdYESHYzNfUCPBPt8bY6fVKPpGdk6 cgTWimzaIWUj/bOcQ0FgwNwdSnLurvZS/ueYGs7PQANUghlZWOgMOxLGTGo4Ovt1+rZI h5y5sw8bj7pb30/WOKrTaivQ/SgUxId2FszQKrQ7NrSuV09t2tegPB7qorPXapJ6jToh KbwS7v+PPSq/GndkC9tuh6wHdH/bIYH0ycRJxmKJMRq0qa0vWTx72M6H/JOvhjKequAd jt8Q== X-Gm-Message-State: ALoCoQl96Tg79t5/2EL3pkj4OwjCZz/ZAJ71hQs9GavzpnA+7O7agmxKlPcXVstPSISNzX1GW7km X-Received: by 10.66.55.41 with SMTP id o9mr105637483pap.148.1436194775912; Mon, 06 Jul 2015 07:59:35 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id up4sm11705855pab.7.2015.07.06.07.59.33 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 07:59:34 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Mon, 06 Jul 2015 21:59:29 +0700 Message-ID: <0C834A8B-F2D7-4521-8C7F-F57EE9F919BF@arbor.net> In-Reply-To: <10e47829935f4105893c893ab1c92d1f@ustx2ex-dag1mb2.msg.corp.akamai.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> <10e47829935f4105893c893ab1c92d1f@ustx2ex-dag1mb2.msg.corp.akamai.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 14:59:38 -0000 On 6 Jul 2015, at 21:42, Salz, Rich wrote: > The question is whether the existing widely deployed protocols are > good enough, or whether adding one that isn't widely deployed is a net > positive or not, right? Yes. One data point to consider is that vendor-proprietary solutions have met with some success utilizing widely-deployed transports. That being said, it's imperative that we develop a standards-based mechanism which broadens the participatory scope of DDoS mitigation to potentially encompass all relevant network elements and devices. And that we utilize the tools at hand wherever it makes sense to do so, and that we do this in a timely manner. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 08:02:25 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C8031A89F6 for ; Mon, 6 Jul 2015 08:02:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HDzi-e4L8W_X for ; Mon, 6 Jul 2015 08:02:18 -0700 (PDT) Received: from mail-pd0-x22e.google.com (mail-pd0-x22e.google.com [IPv6:2607:f8b0:400e:c02::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A09721A8A1E for ; Mon, 6 Jul 2015 08:01:41 -0700 (PDT) Received: by pdbdz6 with SMTP id dz6so12236061pdb.0 for ; Mon, 06 Jul 2015 08:01:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=h1zWWRZcd8opkI5RQOXGaixmnEQtYDPHQ8Muc3mNlj8=; b=K5w/T0MScOhZqZqzC8V5zJDnFEKzJtdeXCcaK8fUNMnNEt5BSMeqWcb5wGLAYt9H8U MLWptGVLLDWa+IsPou+b7ZA6xRlePICD+QyRKCH22lFBwxk8EqhZEGAnkGyFF7DPbctw 9RhiV3rsqAq6DLg9MHgAiaETyezY7xw2nag8s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=h1zWWRZcd8opkI5RQOXGaixmnEQtYDPHQ8Muc3mNlj8=; b=TDTGslmP9H1uPYHVkfffkD20SQkxbEpVoZ69m+yJU1CpZnyI6d29RziXbwfHQ5CEkD HFdOe+GTv4cdnaIwAazgi6EwhxKXLYY9MlrLLf1tFo92ZZwnzY/TvEwpbcFBQOeTbW8M u3uEPmJSIR21hbU2wtUZUhVElwIrBy25LmxtmQbhZIaLxTBkU6L3w4xvzSflgYJisoaf kxdAZ6tp3gaiRhsG9NSk7dc8hZ34sOWqYZgaVM0f73GKEIW9vKFWXQ4MW+p9ISzfNR0+ hyVPBqh9/wbos7jUDjzCvx8SiF0ftlhYkbphZWQwVuCI6KllwN89bwxfSDhsu1C3+fZj HMxA== X-Gm-Message-State: ALoCoQnzfhuodgdPz+gdRCGYKCfbCngIvJN4q0iR6NK1GK6wRPt57oLB5U2kL6YBtUciYdTjEwTq X-Received: by 10.70.90.43 with SMTP id bt11mr17090470pdb.98.1436194901334; Mon, 06 Jul 2015 08:01:41 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id gy3sm18561199pbb.42.2015.07.06.08.01.38 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 06 Jul 2015 08:01:40 -0700 (PDT) From: "Roland Dobbins" To: dots@ietf.org Date: Mon, 06 Jul 2015 22:01:35 +0700 Message-ID: In-Reply-To: <559A9757.5070904@flowtools.net> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <4cd5b46cdbb64e9a966030d84f9d6940@ustx2ex-dag1mb2.msg.corp.akamai.com> <10e47829935f4105893c893ab1c92d1f@ustx2ex-dag1mb2.msg.corp.akamai.com> <559A9757.5070904@flowtools.net> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 15:02:23 -0000 On 6 Jul 2015, at 21:57, John Schiel wrote: > Once DOTS is implemented and once SPUD is defined, it may later be > determined SPUD may be a useful protocol. Concur 100% - let's get something usable into the hands of operators within a reasonable timeframe, and then we can turn our attention to emerging efforts like SPUD for follow-on phases of DOTS. ----------------------------------- Roland Dobbins From nobody Mon Jul 6 18:01:37 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E8861A87C3 for ; Mon, 6 Jul 2015 18:01:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B3Qf2kul_LHu for ; Mon, 6 Jul 2015 18:01:35 -0700 (PDT) Received: from mail1.bemta8.messagelabs.com (mail1.bemta8.messagelabs.com [216.82.243.206]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CBF91A87B9 for ; Mon, 6 Jul 2015 18:01:34 -0700 (PDT) Received: from [216.82.241.211] by server-14.bemta-8.messagelabs.com id 1A/17-07016-EE42B955; Tue, 07 Jul 2015 01:01:34 +0000 X-Env-Sender: Scott.Barvick@corero.com X-Msg-Ref: server-6.tower-85.messagelabs.com!1436230893!49313940!1 X-Originating-IP: [71.184.227.49] X-StarScan-Received: X-StarScan-Version: 6.13.16; banners=-,-,- X-VirusChecked: Checked Received: (qmail 1021 invoked from network); 7 Jul 2015 01:01:33 -0000 Received: from mercury.corero.com (HELO MERCURY.corero.com) (71.184.227.49) by server-6.tower-85.messagelabs.com with AES128-SHA encrypted SMTP; 7 Jul 2015 01:01:33 -0000 Received: from MERCURY.corero.com ([fe80::2c05:6b26:abe2:ad24]) by MERCURY.corero.com ([fe80::2c05:6b26:abe2:ad24%19]) with mapi id 14.03.0235.001; Mon, 6 Jul 2015 21:01:33 -0400 From: Scott Barvick To: Roland Dobbins Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuAgACXawCAAK+HAIAAB4+AgAAeL4CAAECi34AAS14A//+97OCAAEYUgIAAtWYA Date: Tue, 7 Jul 2015 01:01:32 +0000 Message-ID: <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> In-Reply-To: <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [24.34.110.88] Content-Type: text/plain; charset="us-ascii" Content-ID: <734CDA5EA8A6EF41A9EC768176D136B0@corero.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "dots@ietf.org" Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 01:01:37 -0000 And I think I need to point out that draft-teague-open-threat-signaling-01.= txt already has a reasonable proposal for communicating the necessary threa= t information using the UDP-based IPFIX signaling channel when under attack= . This is straightforward and has the sophistication to move from higher = protocol value add during normal operations to the required threat signalin= g information when the link or device becomes overwhelmed. Scott On Jul 6, 2015, at 10:12 AM, Roland Dobbins wrote: >=20 > On 6 Jul 2015, at 21:09, Scott Barvick wrote: >=20 >> And one general principle that we cannot forget is that the supplicant o= r the link to it may be under a significant attack when we need all of the = mechanisms to work. >>=20 >> IMO, the one way, outbound telemetry traffic (e.g IPFIX) is the easy par= t. The telemetry information can be/will be resent periodically and ther= e will be a good chance one can get out. >>=20 >> The signaling channel that sends the value-added information, up to and = including of course, the 'signal' is the harder problem. It has more seman= tics associated with it so the requirements across the board will be more s= tringent, but the obvious choices for transports may not perform reliably u= nder a heavy inbound attack. >=20 > Concur 100%. Also, the notions of mutual authentication and privacy prot= ections are applicable, here. >=20 > ----------------------------------- > Roland Dobbins >=20 > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Tue Jul 7 00:38:25 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82AB61A1A11 for ; Tue, 7 Jul 2015 00:38:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RLonLnjJIlyx for ; Tue, 7 Jul 2015 00:38:22 -0700 (PDT) Received: from mail-pd0-x22b.google.com (mail-pd0-x22b.google.com [IPv6:2607:f8b0:400e:c02::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 844EB1A1A25 for ; Tue, 7 Jul 2015 00:38:21 -0700 (PDT) Received: by pddu5 with SMTP id u5so33500073pdd.3 for ; Tue, 07 Jul 2015 00:38:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=51NA1T8vUgJpi2ScvHa+aE0Q2Bko9rz9x701FFCNjX4=; b=Qq+VBzRNMa8J6xGe8NlUEjn3imHW/M5i3aXbVzgjhYfHvMMb05DsACXzaQlJiFD/CY ENo8vh9lNLhY/yJ9XSvTkAGp6wPsa5m8wHqODsq/vBDHDVY8K80cZ3Y1S1HCYX7ELN/d cn1cZdlyYpFvfAF8DlqIU0HKjeMHjr1fu04ZQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=51NA1T8vUgJpi2ScvHa+aE0Q2Bko9rz9x701FFCNjX4=; b=IcM552Dubx6T67kfVP0IkT59ALqRuJhNd5KJnX7qBfs45NKo5KFK1tppeDHXrDxlW7 iQdVwm5kL0RdyoHp6OpvMkDH8GSecrGlEUXclVXgw9P2bo8zw9kV2+AdJBesHYH9huES uwwKB7z681Cm0UtHWB9YgwNvnJ2GjAbxUOxROeKVKy9xErSBWYQG08FyDLL7cfH/RtY8 vK/yRJBYiFT66aDi0mA7baQiAv43jKZt0+MQQ8BMU1s+1LwPNnUftH4N0Zq40oy7NEWz WCKWELUv0+JhBcHUMhCMsRguz9oiACWl4zOICQp8lYMAdq01xZQ4+y8B9p15JWqsXzYW m6lw== X-Gm-Message-State: ALoCoQmcNsw6c/t5JdHM1+J4LIBxEsZlhuDbCVnw91XL3FmPHyRuGsBdKJMhsPTCHf/B2Bk8eBfy X-Received: by 10.66.63.70 with SMTP id e6mr6119530pas.62.1436254700962; Tue, 07 Jul 2015 00:38:20 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id 1sm20785492pds.79.2015.07.07.00.38.17 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 07 Jul 2015 00:38:19 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Tue, 07 Jul 2015 14:38:14 +0700 Message-ID: In-Reply-To: <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 07:38:24 -0000 On 7 Jul 2015, at 8:01, Scott Barvick wrote: > And I think I need to point out that > draft-teague-open-threat-signaling-01.txt already has a reasonable > proposal for communicating the necessary threat information using the > UDP-based IPFIX signaling channel when under attack. Concur that IPFIX is certainly a viable candidate for this functionality; however, we need to ensure we've a complete set of requirements defined in order to guide our ultimate decisions in this regard. ----------------------------------- Roland Dobbins From nobody Tue Jul 7 04:09:09 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E70461A21BF for ; Tue, 7 Jul 2015 04:09:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.078 X-Spam-Level: ** X-Spam-Status: No, score=2.078 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, CHARSET_FARAWAY_HEADER=3.2, CN_BODY_35=0.339, MIME_8BIT_HEADER=0.3, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Di-JHSVvBn1b for ; Tue, 7 Jul 2015 04:09:06 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CD531A00D8 for ; Tue, 7 Jul 2015 04:09:01 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml406-hub.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BYK95543; Tue, 07 Jul 2015 11:09:00 +0000 (GMT) Received: from SZXEMA414-HUB.china.huawei.com (10.82.72.73) by lhreml406-hub.china.huawei.com (10.201.5.243) with Microsoft SMTP Server (TLS) id 14.3.158.1; Tue, 7 Jul 2015 12:08:59 +0100 Received: from SZXEMA502-MBS.china.huawei.com ([169.254.4.171]) by SZXEMA414-HUB.china.huawei.com ([10.82.72.73]) with mapi id 14.03.0158.001; Tue, 7 Jul 2015 19:08:53 +0800 From: "Xialiang (Frank)" To: Roland Dobbins Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQtuzLhXbDI56Kr0yz7njt73zQ1Z3MxAuA///OQQCAAK+HAIAAB46AgAAeMICAAQniUf//gh4AgAADTYCAAACzgIAAtWYAgABu1gCAALyjYA== Date: Tue, 7 Jul 2015 11:08:52 +0000 Message-ID: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.135.43.91] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Cc: "dots@ietf.org" Subject: [Dots] =?gb2312?b?tPC4tDogIE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBm?= =?gb2312?b?b3IgZHJhZnQtdGVhZ3VlLW9wZW4tdGhyZWF0LXNpZ25hbGluZy0wMS50eHQ=?= X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 11:09:08 -0000 U28sIG91ciBjdXJyZW50IGNvbnNlbnN1cyBpcyB0aGF0IHdlIGdvIG9uIHdvcmtpbmcgb24gdGhl IHRyYW5zcG9ydCBvZiBpcGZpeCBvdmVyIHVkcCBmb3IgdGhlIHRpbWVseSBvdXRwdXQuIE1lYW53 aGlsZSwgd2UgY2FuIG9ic2VydmUgYW5kIGRpc2N1c3MgdGhlIG90aGVyIG9wdGlvbnMgYW5kIG1h eWJlIGNvbnNpZGVyIHRoZW0gd2hlbiB0aW1lIGlzIGFwcHJvcHJpYXRlLg0KSXMgaXQgcmlnaHQ/ DQoNCi0tLS0t08q8/tStvP4tLS0tLQ0Kt6K8/sjLOiBEb3RzIFttYWlsdG86ZG90cy1ib3VuY2Vz QGlldGYub3JnXSC0+rHtIFJvbGFuZCBEb2JiaW5zDQq3osvNyrG85DogMjAxNcTqN9TCN8jVIDE1 OjM4DQrK1bz+yMs6IGRvdHNAaWV0Zi5vcmcNCtb3zOI6IFJlOiBbRG90c10gTmV3IFZlcnNpb24g Tm90aWZpY2F0aW9uIGZvciBkcmFmdC10ZWFndWUtb3Blbi10aHJlYXQtc2lnbmFsaW5nLTAxLnR4 dA0KDQoNCk9uIDcgSnVsIDIwMTUsIGF0IDg6MDEsIFNjb3R0IEJhcnZpY2sgd3JvdGU6DQoNCj4g QW5kIEkgdGhpbmsgSSBuZWVkIHRvIHBvaW50IG91dCB0aGF0DQo+IGRyYWZ0LXRlYWd1ZS1vcGVu LXRocmVhdC1zaWduYWxpbmctMDEudHh0IGFscmVhZHkgaGFzIGEgcmVhc29uYWJsZSANCj4gcHJv cG9zYWwgZm9yIGNvbW11bmljYXRpbmcgdGhlIG5lY2Vzc2FyeSB0aHJlYXQgaW5mb3JtYXRpb24g dXNpbmcgdGhlIA0KPiBVRFAtYmFzZWQgSVBGSVggc2lnbmFsaW5nIGNoYW5uZWwgd2hlbiB1bmRl ciBhdHRhY2suDQoNCkNvbmN1ciB0aGF0IElQRklYIGlzIGNlcnRhaW5seSBhIHZpYWJsZSBjYW5k aWRhdGUgZm9yIHRoaXMgZnVuY3Rpb25hbGl0eTsgaG93ZXZlciwgd2UgbmVlZCB0byBlbnN1cmUg d2UndmUgYSBjb21wbGV0ZSBzZXQgb2YgcmVxdWlyZW1lbnRzIGRlZmluZWQgaW4gb3JkZXIgdG8g Z3VpZGUgb3VyIHVsdGltYXRlIGRlY2lzaW9ucyBpbiB0aGlzIHJlZ2FyZC4NCg0KLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NClJvbGFuZCBEb2JiaW5zIDxyZG9iYmluc0BhcmJv ci5uZXQ+DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f DQpEb3RzIG1haWxpbmcgbGlzdA0KRG90c0BpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9kb3RzDQo= From nobody Tue Jul 7 04:36:19 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEE8C1ABD36 for ; Tue, 7 Jul 2015 04:36:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aGw6Bkr07D3c for ; Tue, 7 Jul 2015 04:36:17 -0700 (PDT) Received: from mail-pa0-x22a.google.com (mail-pa0-x22a.google.com [IPv6:2607:f8b0:400e:c03::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A09B61ABB1A for ; Tue, 7 Jul 2015 04:36:17 -0700 (PDT) Received: by pactm7 with SMTP id tm7so112108106pac.2 for ; Tue, 07 Jul 2015 04:36:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=dnBE/wfgbMiA1meCdC5kH16R7/P6oFf+ZFTD/kG65Gg=; b=QdCq5wzs0ze7JiEdXsx4jsLlT0M7fCLU1HRXuAX3xtxh2HekcfEhftMJXFDXp2Bf8Y cjo878fMwVGKDFHLoCuekxaqaY8wD8wV4DJXKRVMRcfCQIrKAunsMSz9ynj6swFf3Nju /tVRWtT6/CitAsDMM38qyxhrsIdadh2i/fcT0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=dnBE/wfgbMiA1meCdC5kH16R7/P6oFf+ZFTD/kG65Gg=; b=ETnIopIL5vbtXEelQ+5n8I4nH80TVFp83bCoABoikYoxE3F2ryGTL3rxA6UDiVj8py f3lQqRsM1LsJd2TdaYcTE9azB8Uv/TvnDvXp0Gp2Wea4EwVJeO7MH4sJwJOrbNhhYPrD o05apt8PRBScGKBF+wLk9FB6yuNpwfx21JRNE8XnO+mkCXqO1gKJ7khq7zBle1bN37CB 1eOpE98EDQEkAk4+vEYhkqD2vGyqnlOPSzBcUSq8Ui2u+yh4ebgjpGmBjMYCbWnH/JTz PABkYhu4Sm8X5WCrMnmKl0eFf90r6K+EodVe1M8lAuNsgsxmU/5KbtggG8eoqWlAV1XC Rgkw== X-Gm-Message-State: ALoCoQlM2XGXwOPD8fbcV/qrCuea0C6gdi4XViPbkSC5GJ6e2xDhb5JcM5ut76NzCCOr81s0q02P X-Received: by 10.70.91.79 with SMTP id cc15mr8157861pdb.10.1436268977362; Tue, 07 Jul 2015 04:36:17 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id mp3sm21552445pbc.8.2015.07.07.04.36.14 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 07 Jul 2015 04:36:16 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Tue, 07 Jul 2015 18:36:11 +0700 Message-ID: In-Reply-To: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 11:36:19 -0000 On 7 Jul 2015, at 18:08, Xialiang (Frank) wrote: > So, our current consensus is that we go on working on the transport of > ipfix over udp for the timely output. I individually believe that this potential avenue should be thoroughly investigated; however, it's far too early to say we've attained consensus in this regard. > Meanwhile, we can observe and discuss the other options and maybe > consider them when time is appropriate. Yes, this is the current position. ----------------------------------- Roland Dobbins From nobody Tue Jul 7 05:47:21 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC2361A01AA for ; Tue, 7 Jul 2015 05:47:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hQRSrqyuWej7 for ; Tue, 7 Jul 2015 05:47:17 -0700 (PDT) Received: from mail1.bemta12.messagelabs.com (mail1.bemta12.messagelabs.com [216.82.251.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA29F1A01BA for ; Tue, 7 Jul 2015 05:47:17 -0700 (PDT) Received: from [216.82.250.179] by server-8.bemta-12.messagelabs.com id 8A/83-22808-55ACB955; Tue, 07 Jul 2015 12:47:17 +0000 X-Env-Sender: Scott.Barvick@corero.com X-Msg-Ref: server-7.tower-210.messagelabs.com!1436273234!17305940!1 X-Originating-IP: [71.184.227.49] X-StarScan-Received: X-StarScan-Version: 6.13.16; banners=-,-,- X-VirusChecked: Checked Received: (qmail 24612 invoked from network); 7 Jul 2015 12:47:15 -0000 Received: from mercury.corero.com (HELO MERCURY.corero.com) (71.184.227.49) by server-7.tower-210.messagelabs.com with AES128-SHA encrypted SMTP; 7 Jul 2015 12:47:15 -0000 Received: from MERCURY.corero.com ([fe80::2c05:6b26:abe2:ad24]) by MERCURY.corero.com ([fe80::2c05:6b26:abe2:ad24%19]) with mapi id 14.03.0235.001; Tue, 7 Jul 2015 08:47:14 -0400 From: Scott Barvick To: Roland Dobbins , "dots@ietf.org" Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQuKkmEdu3bgsJt02jkCNOljoeQ53P9MCA Date: Tue, 7 Jul 2015 12:47:13 +0000 Message-ID: References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.2.150604 x-originating-ip: [192.168.60.121] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 12:47:19 -0000 I agree with Roland. We are making a standard that needs to support a breadth of use cases, but having a sense of a solution that can satisfy the arguably most difficult networking situation utilizing a base of existing capabilities is comforting. Scott=20 On 7/7/15, 7:36 AM, "Dots on behalf of Roland Dobbins" wrote: > >On 7 Jul 2015, at 18:08, Xialiang (Frank) wrote: > >> So, our current consensus is that we go on working on the transport of >> ipfix over udp for the timely output. > >I individually believe that this potential avenue should be thoroughly >investigated; however, it's far too early to say we've attained >consensus in this regard. > >> Meanwhile, we can observe and discuss the other options and maybe >> consider them when time is appropriate. > >Yes, this is the current position. > >----------------------------------- >Roland Dobbins > >_______________________________________________ >Dots mailing list >Dots@ietf.org >https://www.ietf.org/mailman/listinfo/dots From nobody Tue Jul 7 06:06:04 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4461F1A038D for ; Tue, 7 Jul 2015 06:06:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.988 X-Spam-Level: * X-Spam-Status: No, score=1.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, CHARSET_FARAWAY_HEADER=3.2, CN_BODY_35=0.339, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_8BIT_HEADER=0.3, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r9t-Gqr53Ntn for ; Tue, 7 Jul 2015 06:06:00 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F11A1A038B for ; Tue, 7 Jul 2015 06:06:00 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id t67D5xq6008578 for ; Tue, 7 Jul 2015 09:05:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1436274359; bh=G8lJ3po7PgdWDiAjPZrWyx4ZWPGzCp4AkPiBeMjgVsM=; h=From:To:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To:Cc; b=G93ewk5U9slNCkF46MOIFmQZntit+e30G4rTYRrc4TB3FFYxup+jnVcFvlgao3Mo9 4vsn+rQu3uQPs3kN//d1Gzq1GdRAZM1KNBDNOUhgO4gew9eVARPZaCxMCr5Nm73mBb JvlhdhNCQcfIhsTyX/bUDCA1WViqdbn2rsLOw39c= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by timber.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id t67D5xek012187 for ; Tue, 7 Jul 2015 09:05:59 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0210.002; Tue, 7 Jul 2015 09:05:58 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: =?gb2312?B?W0RvdHNdILTwuLQ6ICBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRy?= =?gb2312?Q?aft-teague-open-threat-signaling-01.txt?= Thread-Index: AQHQuKVd7MqDp2FrRUytKqrkyODjKJ3P+HkQ Date: Tue, 7 Jul 2015 13:05:57 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD94AA52E@marathon> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] =?gb2312?b?tPC4tDogIE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBm?= =?gb2312?b?b3IgZHJhZnQtdGVhZ3VlLW9wZW4tdGhyZWF0LXNpZ25hbGluZy0wMS50eHQ=?= X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 13:06:02 -0000 QW55IGFsdGVybmF0aXZlIHZpZXdzIG9uIHdoZXJlIHRoZSBzdGFydGluZyBwb2ludCBzaG91bGQg YmUgZm9yIHRyYW5zcG9ydCBhbmQgZW5jb2Rpbmc/DQoNClJvbWFuDQoNCj4gLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogRG90cyBbbWFpbHRvOmRvdHMtYm91bmNlc0BpZXRmLm9y Z10gT24gQmVoYWxmIE9mIFhpYWxpYW5nIChGcmFuaykNCj4gU2VudDogVHVlc2RheSwgSnVseSAw NywgMjAxNSA3OjA5IEFNDQo+IFRvOiBSb2xhbmQgRG9iYmlucw0KPiBDYzogZG90c0BpZXRmLm9y Zw0KPiBTdWJqZWN0OiBbRG90c10gtPC4tDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBk cmFmdC10ZWFndWUtb3Blbi0NCj4gdGhyZWF0LXNpZ25hbGluZy0wMS50eHQNCj4gDQo+IFNvLCBv dXIgY3VycmVudCBjb25zZW5zdXMgaXMgdGhhdCB3ZSBnbyBvbiB3b3JraW5nIG9uIHRoZSB0cmFu c3BvcnQgb2YgaXBmaXgNCj4gb3ZlciB1ZHAgZm9yIHRoZSB0aW1lbHkgb3V0cHV0LiBNZWFud2hp bGUsIHdlIGNhbiBvYnNlcnZlIGFuZCBkaXNjdXNzIHRoZQ0KPiBvdGhlciBvcHRpb25zIGFuZCBt YXliZSBjb25zaWRlciB0aGVtIHdoZW4gdGltZSBpcyBhcHByb3ByaWF0ZS4NCj4gSXMgaXQgcmln aHQ/DQo+IA0KPiAtLS0tLdPKvP7Urbz+LS0tLS0NCj4gt6K8/sjLOiBEb3RzIFttYWlsdG86ZG90 cy1ib3VuY2VzQGlldGYub3JnXSC0+rHtIFJvbGFuZCBEb2JiaW5zDQo+ILeiy83KsbzkOiAyMDE1 xOo31MI3yNUgMTU6MzgNCj4gytW8/sjLOiBkb3RzQGlldGYub3JnDQo+INb3zOI6IFJlOiBbRG90 c10gTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC10ZWFndWUtb3Blbi10aHJlYXQt DQo+IHNpZ25hbGluZy0wMS50eHQNCj4gDQo+IA0KPiBPbiA3IEp1bCAyMDE1LCBhdCA4OjAxLCBT Y290dCBCYXJ2aWNrIHdyb3RlOg0KPiANCj4gPiBBbmQgSSB0aGluayBJIG5lZWQgdG8gcG9pbnQg b3V0IHRoYXQNCj4gPiBkcmFmdC10ZWFndWUtb3Blbi10aHJlYXQtc2lnbmFsaW5nLTAxLnR4dCBh bHJlYWR5IGhhcyBhIHJlYXNvbmFibGUNCj4gPiBwcm9wb3NhbCBmb3IgY29tbXVuaWNhdGluZyB0 aGUgbmVjZXNzYXJ5IHRocmVhdCBpbmZvcm1hdGlvbiB1c2luZyB0aGUNCj4gPiBVRFAtYmFzZWQg SVBGSVggc2lnbmFsaW5nIGNoYW5uZWwgd2hlbiB1bmRlciBhdHRhY2suDQo+IA0KPiBDb25jdXIg dGhhdCBJUEZJWCBpcyBjZXJ0YWlubHkgYSB2aWFibGUgY2FuZGlkYXRlIGZvciB0aGlzIGZ1bmN0 aW9uYWxpdHk7DQo+IGhvd2V2ZXIsIHdlIG5lZWQgdG8gZW5zdXJlIHdlJ3ZlIGEgY29tcGxldGUg c2V0IG9mIHJlcXVpcmVtZW50cyBkZWZpbmVkDQo+IGluIG9yZGVyIHRvIGd1aWRlIG91ciB1bHRp bWF0ZSBkZWNpc2lvbnMgaW4gdGhpcyByZWdhcmQuDQo+IA0KPiAtLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLQ0KPiBSb2xhbmQgRG9iYmlucyA8cmRvYmJpbnNAYXJib3IubmV0Pg0K PiANCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4g RG90cyBtYWlsaW5nIGxpc3QNCj4gRG90c0BpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2RvdHMNCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCj4gRG90cyBtYWlsaW5nIGxpc3QNCj4gRG90c0BpZXRmLm9yZw0K PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RvdHMNCg== From nobody Tue Jul 7 06:09:37 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D4EE1A0404 for ; Tue, 7 Jul 2015 06:09:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NhMle2me0DZN for ; Tue, 7 Jul 2015 06:09:35 -0700 (PDT) Received: from mail-pa0-x22d.google.com (mail-pa0-x22d.google.com [IPv6:2607:f8b0:400e:c03::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43A2A1A03E3 for ; Tue, 7 Jul 2015 06:09:35 -0700 (PDT) Received: by pacws9 with SMTP id ws9so114648240pac.0 for ; Tue, 07 Jul 2015 06:09:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-type; bh=l2aTODOodGTe4K83Bz6uxHiR85tESG3NUqjtbNEWtww=; b=CZPQlmj+2eFNzZPrIVabewRHrE1+ATg8o7k8iK8VKPDS9d5h0D9sxlRJ/7DXXDSPCO mNLmEcy5BCQwAGbLNH+HV04I5RCXbpPFFtoUxfMuAjT/aBTNhAtIKDzh3pHR5TBX3TUi qhKVV/ah8tS+1HO9UXSNxEMa3q1akMH2QxzqU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-type; bh=l2aTODOodGTe4K83Bz6uxHiR85tESG3NUqjtbNEWtww=; b=YKzzilKWtM2lmvJ/7aHMxx9VlrRzNH2CxdWiXxRhgpb53QqE0AdqT660upU/jeKX2a YfBdNhmZxbF48l8h49rAxGGnP5k+44JYQ1swxu3X9sSleFCIbeLozVlnjwXmuJSlf+iX NEwRmXA5FqAjygXGpEEF+xqaEJzJfdWEOTdffhh/JCBjROjVQVZBwvxwMkTjPKd3nfDG mhZLDOl87N20ynFo3Zsg0mbz0P3D1tJoa52z23wd9qy+swRVsHR+45urYLrZhcmoW93T ZHgDOJF7XlC+/Ofz6Xaa1VfKq/yaZBrC6rb0wK3d95nZHJuhMsUlvqzoF7bbrmStLhpu /82g== X-Gm-Message-State: ALoCoQn667zmW1I8N6N6mnjxpbksYLc8u2spTw9y58JJw+srye+idOx6SKPoLap13zdKLIVk/9f8 X-Received: by 10.67.3.9 with SMTP id bs9mr8887660pad.136.1436274574955; Tue, 07 Jul 2015 06:09:34 -0700 (PDT) Received: from [172.19.254.121] (202-176-81-112.static.asianet.co.th. [202.176.81.112]) by mx.google.com with ESMTPSA id b12sm21845294pbu.20.2015.07.07.06.09.32 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 07 Jul 2015 06:09:33 -0700 (PDT) From: "Roland Dobbins" To: "dots@ietf.org" Date: Tue, 07 Jul 2015 20:09:28 +0700 Message-ID: In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD94AA52E@marathon> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> <359EC4B99E040048A7131E0F4E113AFCD94AA52E@marathon> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.9.1r5084) Archived-At: Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 13:09:36 -0000 On 7 Jul 2015, at 20:05, Roman D. Danyliw wrote: > Any alternative views on where the starting point should be for > transport and encoding? Defining the actual functional and operational requirements for DOTS should be the starting-point, IMHO. ----------------------------------- Roland Dobbins From nobody Tue Jul 7 06:18:00 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 915DD1A6F04 for ; Tue, 7 Jul 2015 06:17:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yhd8MITtUsaS for ; Tue, 7 Jul 2015 06:17:57 -0700 (PDT) Received: from shetland.sei.cmu.edu (shetland.sei.cmu.edu [192.58.107.44]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 023011A219E for ; Tue, 7 Jul 2015 06:17:56 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by shetland.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id t67DHtOi002854; Tue, 7 Jul 2015 09:17:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1436275075; bh=AzJsaYj7ciZZcKZTcM3++9+PFxXesYK+AE5txY02TY8=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version:Sender: Reply-To; b=QWcnq6WTDpikrk64wcacCgdb46vC+t7Dh9jiVqjn1bh2OoH1GMMf6anFcM1xYsQr5 vZjQGZBFihRSbIWUuJQ10LXafIRJaYd+DTgKdxqkteaB2IrJXa/FF660Cnsu85cjgI bw/GqJdt+eML0j6AxX0oqKIsqa8WVXFJ1twps3ls= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by timber.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id t67DHrq9013643; Tue, 7 Jul 2015 09:17:53 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASSINA.ad.sei.cmu.edu ([10.64.28.249]) with mapi id 14.03.0210.002; Tue, 7 Jul 2015 09:17:52 -0400 From: "Roman D. Danyliw" To: Roland Dobbins Thread-Topic: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt Thread-Index: AQHQuLYzhegcnp6zn0SkoDW34fRlA53P/Tom Date: Tue, 7 Jul 2015 13:17:51 +0000 Message-ID: <0EB28884-A093-4AEA-B0DD-55D31FA510A3@cert.org> References: <20150705063547.12045.19116.idtracker@ietfa.amsl.com> <5599F44C.9080001@mti-systems.com> <913383AAA69FF945B8F946018B75898A4788605D@xmb-rcd-x10.cisco.com> <5745D8D7-D4E9-4B0C-AE6B-B2BC7910D6ED@arbor.net> <559a3ca9.2486460a.19e1.ffffa60fSMTPIN_ADDED_BROKEN@mx.google.com> <9BBD187A-92F5-47BD-AD53-EC2BF5A1346C@arbor.net> <005d01d0b7f3$c5f99af0$51ecd0d0$@shallow@jpshallow.com> <6073823821667642A5C884FF3A8807F81F4C468A@MERCURY.corero.com> <9596E049-C0B7-4C34-99EA-3CC404691E5F@arbor.net> <8742C365-9507-4DDD-AB21-D89043D911A5@corero.com> <359EC4B99E040048A7131E0F4E113AFCD94AA52E@marathon>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "dots@ietf.org" Subject: Re: [Dots] New Version Notification for draft-teague-open-threat-signaling-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2015 13:17:58 -0000 Agreed. We should focus on use cases and requirements first! Roman > On Jul 7, 2015, at 9:09 AM, Roland Dobbins wrote: >=20 >=20 >> On 7 Jul 2015, at 20:05, Roman D. Danyliw wrote: >>=20 >> Any alternative views on where the starting point should be for transpor= t and encoding? >=20 > Defining the actual functional and operational requirements for DOTS shou= ld be the starting-point, IMHO. >=20 > ----------------------------------- > Roland Dobbins >=20 > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots >=20 From nobody Tue Jul 14 14:20:49 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85FA01B2D1B for ; Tue, 14 Jul 2015 14:20:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 446iugV0FMM4 for ; Tue, 14 Jul 2015 14:20:47 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED32E1B2B22 for ; Tue, 14 Jul 2015 14:20:46 -0700 (PDT) Received: from pawpaw.sei.cmu.edu (pawpaw.sei.cmu.edu [10.64.21.22]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id t6ELKjkU023197 for ; Tue, 14 Jul 2015 17:20:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1436908845; bh=BoC0darX81HojvbrAAwpxmwb5U8geBK8QEXtOjjGdYE=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version:Sender:Reply-To:Cc: In-Reply-To:References; b=bemYxIwGSGKA/W3RVcSFxVmQrzCHNaKWZYOJxeolhgrGKPRYdrKXAyjVNgkVOnUTQ /pQS9AyXLrAN2Pwf28NT6BeDdwdCqaAzwP2VhxEYXLaIhag+Zu4tWDluUVhLMPF++b IvSuhgZ65X79PLL4LOyNuOqAq/3GqsiB2NxuWuYA= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by pawpaw.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id t6ELKq1p031394 for ; Tue, 14 Jul 2015 17:20:52 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0210.002; Tue, 14 Jul 2015 17:20:44 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: New Version Notification: draft-mortensen-threat-signaling-requirements-00 Thread-Index: AdC+eof6lavIPG88QVmKcn2gZhNZGg== Date: Tue, 14 Jul 2015 21:20:44 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD94B7E5A@marathon> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Dots] New Version Notification: draft-mortensen-threat-signaling-requirements-00 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2015 21:20:48 -0000 Hello! Another draft to help us advance of discussion on requirements has been pub= lished. Roman ---------- To: Subject: I-D ACTION:draft-mortensen-threat-signaling-requirements-00.txt From: Internet-Drafts@ietf.org Date: Mon, 13 Jul 2015 09:21:52 -0700 A new Internet-Draft is available from the on-line Internet-Drafts director= ies. Title : DDoS Open Threat Signaling Requirements Author(s) : A. Mortensen Filename : draft-mortensen-threat-signaling-requirements Pages : 13=20 Date : 2015-07-13=20 =20 This document discusses the requirements for a protocol sufficient for the goals of the DDoS Open Threat Signaling (DOTS) Working Group. A URL for this Internet-Draft is: https://www.ietf.org/internet-drafts/draft-mortensen-threat-signaling-requi= rements-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Jul 19 05:49:21 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 966421ACE85 for ; Sun, 19 Jul 2015 05:49:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.601 X-Spam-Level: X-Spam-Status: No, score=-1.601 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YoP6KRWbF0HG for ; Sun, 19 Jul 2015 05:49:17 -0700 (PDT) Received: from shetland.sei.cmu.edu (shetland.sei.cmu.edu [192.58.107.44]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 548291ACE83 for ; Sun, 19 Jul 2015 05:49:17 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by shetland.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id t6JCnGjO028338 for ; Sun, 19 Jul 2015 08:49:16 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1437310156; bh=xDsQrxgu1cramOZkVgpaRXVmQmWLJyjZ3Aktf8NJfCg=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version:Sender:Reply-To:Cc: In-Reply-To:References; b=RccqWlve1gTJ+jwyPhkoqV72KXylpMAFqIesrQxXhsdcjK2eHtAhbzfvZQ+ReUZvl kCfBc8Qbp2Vnc8AAIi7w9gSu+nshH6+NpEuP2p0tsrOCcsK6PT8NV9wbuLbkN7CI5s 6NkEj8T6tbI6WzZp1/EnHzF3IiWlmbSRwptK6RlQ= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by timber.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id t6JCnE0g014193 for ; Sun, 19 Jul 2015 08:49:14 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0210.002; Sun, 19 Jul 2015 08:49:14 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: Feedback on draft-mortensen-threat-signaling-requirements-00 Thread-Index: AdDCGe8G2il5+6WlTGy+Hn6majGxVw== Date: Sun, 19 Jul 2015 12:49:13 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD94BEA5F@marathon> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Dots] Feedback on draft-mortensen-threat-signaling-requirements-00 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Jul 2015 12:49:20 -0000 Hello Andrew! Thanks again for producing this draft. As an individual contributor, here = are a few thoughts I had. ** The enumeration and definition of possible DOTS elements was helpful. ** Section 2.2: Configurational Channel=20 -- The configuration channel is defined as being RESTful. To everyone but = Andrew, are there contrarian views on this? -- What is meant by "local operator control" in the statement "The RESTful = interface enables local operator control over DOTS elements." Is the text = suggesting control of all DOTS elements by a single operator? ** Section 2.4: Signal -- Minor editorial note; the last sentence of this section is garbled. ** Section 2.5: Signal Response -- IMO, I find the term "Signal Response" confusing given that the text sta= tes that the "... Signal Responses are sent without solicitation by a Signa= ler." ** Section 2.6: Signaler -- If a "A Signaler MAY establish Signal Channels with multiple Signal Hand= ler", can the Signaler request threat handling from multiple Signal Handler= s? Yes, right? ** Section 2.8: Signal Handler -- "A Signal Handler may or may not be in the same domain as the Signaler."= IMO, the term "domain" in this context needs clarity. ** Section 3.1.1: Endpoint Communication -- Are the suggestions made in this section referencing all of DOTS (i.e., = configuration _and_ signaling channel) or just the signaling channel? IMO,= the text is best suited for only the signaling channel. ** Section 3.1.1.1: Signal Channel Health "The protocol SHOULD include a way for each endpoint to detect when their r= espective peers last received a message." -- The term end-point means one of the following: Signalers/Supplicants, Si= gnal Handlers, Signal Relayers or Threat Handlers correct?=20 -- I need help understanding what a peer is for each type of end-point. Wi= th the statement "... [if] the endpoint SHOULD consider the peer unresponsi= ve, ... [it should] in some way alert the operator to the loss of signal". = Which operator? -- Is there anything more to signal channel health than tracking the last t= ime you communicated with a peer? =20 Section 3.3.2: Signal Response "the Signal Response SHOULD deliver feedback to the signaler from the entit= y or entities handling a threat on the signaler's behalf." -- Is this statement implying that a Signal Response could come directly fr= om a Threat Handler to a Supplicant (instead of from the Signal Handler)?=20 Section 4: Configuration Channel -- The list provided in this sections reads like things configured exclusiv= ely on the Signal Handler. Do we need to configure anything on the Signale= r? Regards, Roman From nobody Sun Jul 19 05:49:32 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F4CC1ACE83 for ; Sun, 19 Jul 2015 05:49:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzH1FJz0_FXv for ; Sun, 19 Jul 2015 05:49:27 -0700 (PDT) Received: from plainfield.sei.cmu.edu (plainfield.sei.cmu.edu [192.58.107.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 535BC1ACE7B for ; Sun, 19 Jul 2015 05:49:27 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by plainfield.sei.cmu.edu (8.14.4/8.14.4/1408) with ESMTP id t6JCnQG0024327 for ; Sun, 19 Jul 2015 08:49:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1437310166; bh=58O8n+zPWrwg54Dy9wbQGnkV9Ww65+9stqx3JnKKiTo=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version:Sender:Reply-To:Cc: In-Reply-To:References; b=iKA8V1rCH59i8PNkaPR7TGjA5Di1Fs4uU2CPtwNvSWT6MzZ9Kg+Le9t7sZF/YMi8/ f8CuisQ1Mo8tTTvrOHoqORD5/GtOjYKSwij74E7OFABL61vyuweoJhbBdfxHH6Kta0 WAVG9qOqtwbn5pkG9bbgltFtJjkIfU7L51/WzUJM= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by timber.sei.cmu.edu (8.14.4/8.14.4/1456) with ESMTP id t6JCnKhA014209 for ; Sun, 19 Jul 2015 08:49:20 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASSINA.ad.sei.cmu.edu ([10.64.28.249]) with mapi id 14.03.0210.002; Sun, 19 Jul 2015 08:49:20 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: Status going into the Prague meeting Thread-Index: AdDCIGm19UmymlV+S5+NT/S2IjDJdw== Date: Sun, 19 Jul 2015 12:49:19 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFCD94BEA83@marathon> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Dots] Status going into the Prague meeting X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Jul 2015 12:49:31 -0000 Hello WG! Just a reminder, we're meeting on Tuesday at 1740 in Congress Hall II. Unf= ortunately, we only got 1 hour of official time. As you can see from the a= genda [1], it's very compressed primarily focused on introducing topics lea= ving little time for discussion. Our first order of business is to clarify= what problems DOTS will solve -- requirements and use cases. To date, two independent drafts [2] [3] and mailing list discussions have v= oiced the following use cases: (1) "On-premise: Symmetric" (Section 3.1 of [2]) (2) "On-premise: Assymetric" (Section 3.2 of [2]) (3) "Cloud" (Section 4 of [2]) (4) "Data mining DDOS protection" (Section 3 of [3]) (5) "NFV Based Distributed DDoS Mitigation" (Section 4 of [3]) (6) "Inbound link saturation attack" (Item 1 of [5]) (7) "N/M inline mitigation through traffic redirection" (Item 2 of [5]) (8) "Virtualized DDoS mitigation appliance" (Item 3 of [5]) If you have additional use cases, please let your thoughts be known on the = list. From the list of articulated use cases, we need to discuss their sui= tability for the WG, overlap between each other and whether their scope is = sufficiently understood. If you have thoughts on any of those, please comm= ent. Another independent draft [4] introduced a set of requirements. The specif= ic draft and the requirements conversation overall needs further discussion= . A number of individual drafts discussing transport [6] [8] and data model [= 6] [7] [9] have been updated since the BOF [6] [7] and others are new [8] [= 9] since we met in Dallas. While it is premature to delve into the specifi= cs, they too can inform our requirements and use case discussion. Please r= eview these as well. Safe travels to Prague! Roman [1] https://www.ietf.org/proceedings/93/agenda/agenda-93-dots=20 [2] draft-mglt-dots-use-cases-00 [3] draft-xia-dots-extended-use-cases-00 [4] draft-mortensen-threat-signaling-requirements-00 [5] https://mailarchive.ietf.org/arch/msg/dots/QrPIV2Yl2vNaG3um3jMyrMOo8IY [6] draft-teague-open-threat-signaling-01 [7] draft-fu-ipfix-network-security-01 [8] draft-reddy-dots-transport-00 [9] draft-reddy-dots-info-model-00 From nobody Sun Jul 19 06:45:19 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F17591ACF58 for ; Sun, 19 Jul 2015 06:45:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -96.664 X-Spam-Level: X-Spam-Status: No, score=-96.664 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FH_HELO_EQ_D_D_D_D=1.597, HELO_DYNAMIC_IPADDR=1.951, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZYSrhR8ehJxp for ; Sun, 19 Jul 2015 06:45:16 -0700 (PDT) Received: from lvps5-35-241-16.dedicated.hosteurope.de (www.gondrom.org [5.35.241.16]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D8E61ACF19 for ; Sun, 19 Jul 2015 06:45:16 -0700 (PDT) Received: from [31.133.163.248] (dhcp-a3f8.meeting.ietf.org [31.133.163.248]) by lvps5-35-241-16.dedicated.hosteurope.de (Postfix) with ESMTPSA id 9D4B663836; Sun, 19 Jul 2015 15:45:14 +0200 (CEST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gondrom.org; b=tFuo2pXTZQ589lydFJQRdG3HnpSHz9TtzLLj51/sF2TfHuO1Sui7WLkghSLi1KzGiYarbPa1dmwnwhK86FOEM5fcfShImlbiDcmB3FSZRTovXmYF0t4fNfUT7hDbuzfcTj/rpf1V+v6VebIFud26mX7tTXrfqrSNmOMzyZ3n+tU=; h=Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:References:In-Reply-To:Content-Type; Message-ID: <55ABA9EA.4050608@gondrom.org> Date: Sun, 19 Jul 2015 15:45:14 +0200 From: Tobias Gondrom User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: dots@ietf.org References: <359EC4B99E040048A7131E0F4E113AFCD94BEA83@marathon> In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD94BEA83@marathon> Content-Type: multipart/alternative; boundary="------------020305030309000102080606" Archived-At: Cc: rdd@cert.org Subject: Re: [Dots] Status going into the Prague meeting X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Jul 2015 13:45:18 -0000 This is a multi-part message in MIME format. --------------020305030309000102080606 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Hello dear DOTS WG colleagues, small remarks: 1. we still need to update the WG meeting materials. @presenters: If you have scheduled a presentation slot, please send your slides to Roman and myself until Monday night (24:00) local time, so we can upload the material in time for our meeting. Please keep in mind that our time for this meeting is quite constrained and we also need time for our discussion. So please do not use more time that has been allocated so far... 2. as our agenda is quite compressed, we may need to further streamline / update our agenda a little bit tomorrow to allow us to achieve results on requirements, use case and identifying our next steps forward. Roman and I shall make this minor agenda adjustment tomorrow afternoon. (apologise for this possible last minute planning adjustment). Best regards, Tobias (co-chair of DOTS) On 19/07/15 14:49, Roman D. Danyliw wrote: > Hello WG! > > Just a reminder, we're meeting on Tuesday at 1740 in Congress Hall II. Unfortunately, we only got 1 hour of official time. As you can see from the agenda [1], it's very compressed primarily focused on introducing topics leaving little time for discussion. Our first order of business is to clarify what problems DOTS will solve -- requirements and use cases. > > To date, two independent drafts [2] [3] and mailing list discussions have voiced the following use cases: > > (1) "On-premise: Symmetric" (Section 3.1 of [2]) > (2) "On-premise: Assymetric" (Section 3.2 of [2]) > (3) "Cloud" (Section 4 of [2]) > (4) "Data mining DDOS protection" (Section 3 of [3]) > (5) "NFV Based Distributed DDoS Mitigation" (Section 4 of [3]) > (6) "Inbound link saturation attack" (Item 1 of [5]) > (7) "N/M inline mitigation through traffic redirection" (Item 2 of [5]) > (8) "Virtualized DDoS mitigation appliance" (Item 3 of [5]) > > If you have additional use cases, please let your thoughts be known on the list. From the list of articulated use cases, we need to discuss their suitability for the WG, overlap between each other and whether their scope is sufficiently understood. If you have thoughts on any of those, please comment. > > Another independent draft [4] introduced a set of requirements. The specific draft and the requirements conversation overall needs further discussion. > > A number of individual drafts discussing transport [6] [8] and data model [6] [7] [9] have been updated since the BOF [6] [7] and others are new [8] [9] since we met in Dallas. While it is premature to delve into the specifics, they too can inform our requirements and use case discussion. Please review these as well. > > Safe travels to Prague! > Roman > > [1] https://www.ietf.org/proceedings/93/agenda/agenda-93-dots > [2] draft-mglt-dots-use-cases-00 > [3] draft-xia-dots-extended-use-cases-00 > [4] draft-mortensen-threat-signaling-requirements-00 > [5] https://mailarchive.ietf.org/arch/msg/dots/QrPIV2Yl2vNaG3um3jMyrMOo8IY > [6] draft-teague-open-threat-signaling-01 > [7] draft-fu-ipfix-network-security-01 > [8] draft-reddy-dots-transport-00 > [9] draft-reddy-dots-info-model-00 > > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots --------------020305030309000102080606 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Hello dear DOTS WG colleagues,

small remarks:
1. we still need to update the WG meeting materials.
@presenters: If you have scheduled a presentation slot, please send your slides to Roman and myself until Monday night (24:00) local time, so we can upload the material in time for our meeting. Please keep in mind that our time for this meeting is quite constrained and we also need time for our discussion. So please do not use more time that has been allocated so far...

2. as our agenda is quite compressed, we may need to further streamline / update our agenda a little bit tomorrow to allow us to achieve results on requirements, use case and identifying our next steps forward. Roman and I shall make this minor agenda adjustment tomorrow afternoon. (apologise for this possible last minute planning adjustment).

Best regards, Tobias� (co-chair of DOTS)


On 19/07/15 14:49, Roman D. Danyliw wrote:
Hello WG!

Just a reminder, we're meeting on Tuesday at 1740 in Congress Hall II.  Unfortunately, we only got 1 hour of official time.  As you can see from the agenda [1], it's very compressed primarily focused on introducing topics leaving little time for discussion.  Our first order of business is to clarify what problems DOTS will solve -- requirements and use cases.

To date, two independent drafts [2] [3] and mailing list discussions have voiced the following use cases:

(1) "On-premise: Symmetric" (Section 3.1 of [2])
(2) "On-premise: Assymetric" (Section 3.2 of [2])
(3) "Cloud" (Section 4 of [2])
(4) "Data mining DDOS protection" (Section 3 of [3])
(5) "NFV Based Distributed DDoS Mitigation" (Section 4 of [3])
(6) "Inbound link saturation attack" (Item 1 of [5])
(7) "N/M inline mitigation through traffic redirection" (Item 2 of [5])
(8) "Virtualized DDoS mitigation appliance" (Item 3 of [5])

If you have additional use cases, please let your thoughts be known on the list.  From the list of articulated use cases, we need to discuss their suitability for the WG, overlap between each other and whether their scope is sufficiently understood.  If you have thoughts on any of those, please comment.

Another independent draft [4] introduced a set of requirements.  The specific draft and the requirements conversation overall needs further discussion.

A number of individual drafts discussing transport [6] [8] and data model [6] [7] [9] have been updated since the BOF [6] [7] and others are new [8] [9] since we met in Dallas.  While it is premature to delve into the specifics, they too can inform our requirements and use case discussion.  Please review these as well.

Safe travels to Prague!
Roman

[1] https://www.ietf.org/proceedings/93/agenda/agenda-93-dots 
[2] draft-mglt-dots-use-cases-00
[3] draft-xia-dots-extended-use-cases-00
[4] draft-mortensen-threat-signaling-requirements-00
[5] https://mailarchive.ietf.org/arch/msg/dots/QrPIV2Yl2vNaG3um3jMyrMOo8IY
[6] draft-teague-open-threat-signaling-01
[7] draft-fu-ipfix-network-security-01
[8] draft-reddy-dots-transport-00
[9] draft-reddy-dots-info-model-00

_______________________________________________
Dots mailing list
Dots@ietf.org
https://www.ietf.org/mailman/listinfo/dots

--------------020305030309000102080606-- From nobody Sun Jul 19 19:31:18 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2B211A1A06 for ; Sun, 19 Jul 2015 19:31:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 034NRHWfiz1K for ; Sun, 19 Jul 2015 19:31:15 -0700 (PDT) Received: from mail-ig0-x235.google.com (mail-ig0-x235.google.com [IPv6:2607:f8b0:4001:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D35F71ACE5B for ; Sun, 19 Jul 2015 19:31:14 -0700 (PDT) Received: by igbij6 with SMTP id ij6so72832147igb.1 for ; Sun, 19 Jul 2015 19:31:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=m0; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QloFdMBDLxLMRd/C8JDDsWBdfm+vJUKmuCjez85RER8=; b=kyWT9uDB/PeKFTfQOmZzVX4Rv917LeyS5kN3jyELwTEUebDLktwh1v9Kw8MfSXNH3C b0gkvP3Me4zuf6W6GiVR2nmd3hP/AI0L7Fu2/wv4mxElXa6ZB1YzK1GP6Akl9enNsv9X ed2vrTknw7X5Br7R11/p//UiqcbgZ2StGw/Ag= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=QloFdMBDLxLMRd/C8JDDsWBdfm+vJUKmuCjez85RER8=; b=IM9n2ZFnSUQrwmfyJKUKtR7D3jD9oY7O357vtnLNLuvdOgsPS5hbpYIYt/msrbCGEQ oELFD22XMdrtbplZnZXemY4uNmB0++ThEftaOLn8G9X9pVe9+1VjXwgMxwqH6qyQ18hV +AvLuESFOhooBUj8od3ahygrsINcGTqkUyKreVv4PLkMT2MNu0cJ8Aw5lOaAe/qcR/AZ xmB148n9zPKoaCoxMDuG1gvI6VG8dJEDmvCmiaXMYrp2OCNUfz/Hu/FUaaxNjba1nN3a 7AdgiRpsoEEDba1oOtR9gJ33r9E7WUDBQ8FTFXokqTID4itilXoY1zfeajEKgmoxUI+V CgBQ== X-Gm-Message-State: ALoCoQnUcLFFbVdlF6f2dhZqp8p1z9bnOJHBgnGpA8Bcf0d8qFuMUYbNSFPQiFBAsXVpygwU/Cte X-Received: by 10.107.14.65 with SMTP id 62mr31225039ioo.67.1437359474304; Sun, 19 Jul 2015 19:31:14 -0700 (PDT) Received: from [172.20.1.29] ([89.24.97.7]) by smtp.gmail.com with ESMTPSA id j20sm4411804igt.5.2015.07.19.19.31.12 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 19 Jul 2015 19:31:13 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Andrew Mortensen In-Reply-To: <359EC4B99E040048A7131E0F4E113AFCD94BEA5F@marathon> Date: Sun, 19 Jul 2015 22:31:18 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <359EC4B99E040048A7131E0F4E113AFCD94BEA5F@marathon> To: "Roman D. Danyliw" X-Mailer: Apple Mail (2.2098) Archived-At: Cc: "dots@ietf.org" Subject: Re: [Dots] Feedback on draft-mortensen-threat-signaling-requirements-00 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2015 02:31:17 -0000 Hi Roman. Thanks for taking the time to comment. I appreciate it. I=E2=80=99ve responded inline below. > On Jul 19, 2015, at 8:49 AM, Roman D. Danyliw wrote: > > ** Section 2.2: Configurational Channel=20 > > -- What is meant by "local operator control" in the statement "The = RESTful interface enables local operator control over DOTS elements." = Is the text suggesting control of all DOTS elements by a single = operator? What I was trying to evoke here was the requirement (in my view) that = operators of the signaling element should maintain control over the = scope and triggers of threat handling for network space they own. That = obviously didn=E2=80=99t come through. I=E2=80=99ll reword. > ** Section 2.4: Signal >=20 > -- Minor editorial note; the last sentence of this section is garbled. Copy-pasta corrected, thanks. > ** Section 2.5: Signal Response >=20 > -- IMO, I find the term "Signal Response" confusing given that the = text states that the "... Signal Responses are sent without solicitation = by a Signaler.=E2=80=9D That should have been =E2=80=9C=E2=80=A6solicitation *from* a = Signaler=E2=80=9D, but I agree, the term isn=E2=80=99t ideal. I=E2=80=99ve= had an offline suggestion that =E2=80=9CClient Beacon=E2=80=9D and = =E2=80=9CServer Beacon=E2=80=9D would help make the distinction and the = behavior clearer. I=E2=80=99m open to additional suggestions as well. > ** Section 2.6: Signaler >=20 > -- If a "A Signaler MAY establish Signal Channels with multiple Signal = Handler", can the Signaler request threat handling from multiple Signal = Handlers? Yes, right? Yes. I=E2=80=99ll make that explicit. > ** Section 2.8: Signal Handler >=20 > -- "A Signal Handler may or may not be in the same domain as the = Signaler." IMO, the term "domain" in this context needs clarity. Will clarify. > ** Section 3.1.1: Endpoint Communication >=20 > -- Are the suggestions made in this section referencing all of DOTS = (i.e., configuration _and_ signaling channel) or just the signaling = channel? IMO, the text is best suited for only the signaling channel. Agreed, the text in this draft is entirely focused on the signaling = channel. As my suggestion of a RESTful interface suggests, I=E2=80=99ve = been assuming the configuration channel will use https. I=E2=80=99ll = make that clear. > ** Section 3.1.1.1: Signal Channel Health >=20 > "The protocol SHOULD include a way for each endpoint to detect when = their respective peers last received a message." >=20 > -- The term end-point means one of the following: = Signalers/Supplicants, Signal Handlers, Signal Relayers or Threat = Handlers correct? Correct, except that I did not intend to imply Threat Handlers should = communicate directly with a Signaler unless the Threat Handler is also a = Signal Handler. > -- I need help understanding what a peer is for each type of = end-point. As I had conceived of it, there are only the two types of endpoints for = signaling, the Signaler and the Signal Handler, meaning the peer for a = Signaler is a Signaler Handler, and vice versa. > With the statement "... [if] the endpoint SHOULD consider the peer = unresponsive, ... [it should] in some way alert the operator to the loss = of signal". Which operator? The operator of the endpoint detecting signal degradation. In practice, = both endpoints should notice the problem around the same time if = they=E2=80=99ve agreed on a signal TTL. For example, if the Signal = Handler continues to receiving messages from the Signaler, but the = message indicates the Signaler hasn=E2=80=99t received anything from the = Signal Handler for longer than the TTL, both endpoints should notice and = alert their local operators. > -- Is there anything more to signal channel health than tracking the = last time you communicated with a peer? Some metric communicating e.g. not only the presence of message loss but = also the quantity would be useful. I=E2=80=99m concerned about trying to = pack too much metadata in the signal, so I=E2=80=99m hoping feedback = from the WG and further discussions about the protocol will help refine = this. > Section 3.3.2: Signal Response >=20 > "the Signal Response SHOULD deliver feedback to the signaler from the = entity or entities handling a threat on the signaler's behalf." >=20 > -- Is this statement implying that a Signal Response could come = directly from a Threat Handler to a Supplicant (instead of from the = Signal Handler)? It is, but it shouldn=E2=80=99t be unless the Threat Handler and Signal = Handler are synonymous in the deployment. Thanks for pointing it out. = All communication should be between Signaler and Signal Handler. > Section 4: Configuration Channel >=20 > -- The list provided in this sections reads like things configured = exclusively on the Signal Handler. Do we need to configure anything on = the Signaler? The list does mention the Signaler Handler will be able to specify the = unique identifier the Signaler will use in the signal, but yes, this = section is far from comprehensive. Nik=E2=80=99s draft includes things = like the address of the IPFIX collector (in my terminology, the Signal = Handler), and I neglected that here. andrew From nobody Tue Jul 21 04:45:53 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CFFB1A0396 for ; Tue, 21 Jul 2015 04:45:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HRbKF0_51dOb for ; Tue, 21 Jul 2015 04:45:47 -0700 (PDT) Received: from mail-wi0-x233.google.com (mail-wi0-x233.google.com [IPv6:2a00:1450:400c:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F023D1A0364 for ; Tue, 21 Jul 2015 04:45:46 -0700 (PDT) Received: by wibxm9 with SMTP id xm9so54253316wib.1 for ; Tue, 21 Jul 2015 04:45:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=/cX4mzcmyA/UgAN56KHtiJ6lw7zYig9YoEJIM4CYj+4=; b=lTB/bmgrniBM9bAm9b30nL+QzeSjR0XW9bhKkY4nvg+g0rrJuf1O+3+YUK7X9L2PVs tOGBAxxO9lp1GQL4uylijsNZcKqBryuN8XiNzwiS8KWGa/mFdPIRt4xiiRPrU1K/CpyQ 3r0bXDE3warDcJh/mMBlTi33MERavRD7uXN4KYm+CvaI6kzYGzSTlRZx4S5J2rXzDDcZ SiZ7u3+n+cF8zlSGQ+qRLVHgQu5rp9ldoFpUnvTg0wvprj60VTCUDQZvF7MIlHT9Ky5L n8RVvVq6Abj1iIGXg/td04W6n/V2zk0UF8a5FZgCWPVdnjGV7F+wcftJXZMWcegzCVnO PnDg== MIME-Version: 1.0 X-Received: by 10.194.75.132 with SMTP id c4mr63013722wjw.80.1437479145792; Tue, 21 Jul 2015 04:45:45 -0700 (PDT) Received: by 10.28.31.194 with HTTP; Tue, 21 Jul 2015 04:45:45 -0700 (PDT) Date: Tue, 21 Jul 2015 07:45:45 -0400 Message-ID: From: Kathleen Moriarty To: "dots@ietf.org" Content-Type: multipart/alternative; boundary=047d7bb04b7cdb6c7b051b6131ab Archived-At: Subject: [Dots] DOTS co-chairs X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jul 2015 11:45:52 -0000 --047d7bb04b7cdb6c7b051b6131ab Content-Type: text/plain; charset=UTF-8 Please welcome Tobias Gondrom as the co-chair for DOTS with Roman Danyliw. The chairs contact information is available on the DOTS charter page. A big thank you to Tobias and Roman for helping as chairs to drive the work and assist the WG to reach the milestones and progress this important work with editors and contributors. https://datatracker.ietf.org/wg/dots/charter/ -- Best regards, Kathleen --047d7bb04b7cdb6c7b051b6131ab Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Please welcome=C2=A0Tobias Gondrom as the co-chair for DOT= S with Roman Danyliw.=C2=A0 The chairs contact information is available on = the DOTS charter page.

A big thank you to Tobias and Rom= an for helping as chairs to drive the work and assist the WG to reach the m= ilestones and progress this important work with editors and contributors.

--047d7bb04b7cdb6c7b051b6131ab-- From nobody Thu Jul 23 04:05:54 2015 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B15711A8BC5 for ; Wed, 22 Jul 2015 09:54:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.38 X-Spam-Level: * X-Spam-Status: No, score=1.38 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8-DggEVG2KTF for ; Wed, 22 Jul 2015 09:54:40 -0700 (PDT) Received: from smtpdg4.aruba.it (smtpweb131.aruba.it [62.149.158.131]) by ietfa.amsl.com (Postfix) with ESMTP id F13A91A8BBF for ; Wed, 22 Jul 2015 09:54:39 -0700 (PDT) Received: from dell-tcastaldi ([31.130.224.109]) by smtpcmd04.ad.aruba.it with bizsmtp id vUuD1q00R2NEPrz01UuEyE; Wed, 22 Jul 2015 18:54:14 +0200 Date: Wed, 22 Jul 2015 18:54:15 +0200 (CEST) From: Meetecho Team To: dots@ietf.org Message-ID: <1315968767.1.1437584055223.JavaMail.tcastaldi@dell-tcastaldi> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_0_1756201167.1437584055185" Archived-At: X-Mailman-Approved-At: Thu, 23 Jul 2015 04:05:53 -0700 Subject: [Dots] Meetecho recordings of DOTS WG session X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2015 16:54:41 -0000 ------=_Part_0_1756201167.1437584055185 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Dear all, the full recording (synchronized video, audio, slides and jabber room) of the DOTS WG session at IETF 93 is available at the following URL: http://ietf93.conf.meetecho.com/index.php/Recorded_Sessions#DOTS In case of problems with the playout, just drop an e-mail to ietf-support@meetecho.com. For the chair(s): please feel free to put the link to the recording in the minutes, if you think this might be useful. Cheers, the Meetecho Team ------=_Part_0_1756201167.1437584055185--