From nobody Wed Sep 14 06:40:06 2016 Return-Path: X-Original-To: dots@ietf.org Delivered-To: dots@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0352D12BA01; Wed, 14 Sep 2016 06:40:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: X-Test-IDTracker: no X-IETF-IDTracker: 6.33.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147386040376.1729.15294719193635638375.idtracker@ietfa.amsl.com> Date: Wed, 14 Sep 2016 06:40:03 -0700 Archived-At: Cc: rdd@cert.org, dots-chairs@ietf.org, Kathleen.Moriarty.ietf@gmail.com, dots@ietf.org Subject: [Dots] dots - New Meeting Session Request for IETF 97 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Sep 2016 13:40:04 -0000 A new meeting session request has just been submitted by Roman Danyliw, a Chair of the dots working group. --------------------------------------------------------- Working Group Name: DDoS Open Threat Signaling Area Name: Security Area Session Requester: Roman Danyliw Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 100 Conflicts to Avoid: First Priority: mile sacm i2nsf saag Second Priority: opsawg opsarea Special Requests: --------------------------------------------------------- From nobody Fri Sep 16 05:54:56 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CF6312B138 for ; Fri, 16 Sep 2016 05:54:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.408 X-Spam-Level: X-Spam-Status: No, score=-8.408 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.508] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id swM6WRo6lbTH for ; Fri, 16 Sep 2016 05:54:53 -0700 (PDT) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4ADD812B0E9 for ; Fri, 16 Sep 2016 05:54:53 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.30,344,1470693600"; d="scan'208";a="237108795" Received: from static-176-183-206-74.ncc.abo.bbox.fr (HELO [192.168.1.17]) ([176.183.206.74]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/DHE-RSA-AES128-SHA; 16 Sep 2016 14:54:51 +0200 Message-ID: <57DBEB9A.4010402@inria.fr> Date: Fri, 16 Sep 2016 14:54:50 +0200 From: =?UTF-8?B?SsOpcsO0bWUgRnJhbsOnb2lz?= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: dots@ietf.org Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [Dots] draft-francois-dots-ipv6-signal-option-00 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Sep 2016 12:54:55 -0000 Dear all, We'd like to present our response to the community feedback we received after presenting our draft-francois-dots-ipv6-signal-option-00 draft in Berlin. 1) On the use of the IPv6 Hop-by-Hop options: We recognized that this can be an issue as it may entail some processing overhead at the router side (also described in draft-krishnan-ipv6-hopbyh= op-05). The main issue is the unbounded number of TLV encoded attributes in the option. In our opinion, our proposition is not particularly affected by this threats, due the following: * only DOTS clients may craft such an option. Therefore, with a previously defined policy set, other hosts trying to use it should be easily detected and drop at the first router they will encounter. * we assume that there is a trust relationships between dots agents and the network (remaining that we mainly focus on the intra-domain use case). If not, additional techniques (rate / size limiting) can be applied on the IPv6 packets. * there is some processing overhead but (i) not all routers need to process them (a sort of trade-off between reaching the server and the overhead) and (ii) this overhead would be insignificant regarding the DDoS impact, which in our mind make this more acceptable. 2) The option encodes the same information that the client sends to the server but the main difference is that the propagation will be done in an epidemic manner (i.e. not taking the regular forwarding path, which might even been under attack). One one hand, you can restrict the epidemic propagation towards a certain direction to be sure that the signaling is not going to a direction too far from the sever. On the other hand, we recommend in our draft to use all possible paths in the very first instants of the attack to have more chance to reach the client or a DOTS gateway. In brief, our proposal is intended to be used in intra-domain scenario with distributed gateways rather than only relying only a single DOTS server. We will take those into account in our draft as well as any additional feedback we'll reveive on the ML. We'll also introduce our draft on the ipv6 ML for advice and feedback. We have also started first experiments with running code. Best regards, J=C3=A9r=C3=B4me From nobody Mon Sep 19 18:49:44 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27DFF12B172 for ; Mon, 19 Sep 2016 18:49:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.217 X-Spam-Level: X-Spam-Status: No, score=-4.217 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-2.316, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GORS8NsSvAop for ; Mon, 19 Sep 2016 18:49:39 -0700 (PDT) Received: from guri.nttv6.jp (guri.nttv6.jp [115.69.231.228]) by ietfa.amsl.com (Postfix) with ESMTP id A92E712B155 for ; Mon, 19 Sep 2016 18:49:39 -0700 (PDT) Received: from z.nttv6.jp (z.nttv6.jp [IPv6:2402:c800:ff06:6::f]) by guri.nttv6.jp (NTTv6MTA) with ESMTP id D49954E60E for ; Tue, 20 Sep 2016 10:49:37 +0900 (JST) Received: from SR2-nishizuka.local (fujiko.nttv6.jp [IPv6:2402:c800:ff06:136::141]) by z.nttv6.jp (NTTv6MTA) with ESMTP id B71F93AC80 for ; Tue, 20 Sep 2016 10:49:37 +0900 (JST) References: <147433559423.31088.10699459832556673482.idtracker@ietfa.amsl.com> To: "dots@ietf.org" From: kaname nishizuka X-Forwarded-Message-Id: <147433559423.31088.10699459832556673482.idtracker@ietfa.amsl.com> Message-ID: <7894ca22-40e9-53ee-cb07-028c8c55d936@nttv6.jp> Date: Tue, 20 Sep 2016 10:49:36 +0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <147433559423.31088.10699459832556673482.idtracker@ietfa.amsl.com> Content-Type: multipart/alternative; boundary="------------6FFDEDB32DA5893C771A5F51" Archived-At: Subject: [Dots] Fwd: New Version Notification for draft-nishizuka-dots-inter-domain-usecases-02.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Sep 2016 01:49:42 -0000 This is a multi-part message in MIME format. --------------6FFDEDB32DA5893C771A5F51 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi all, I've just updated my individual usecase draft in order to keep it active status until it will be merged into the WG usecase draft. The consolidated usecases are described in Section 5 which reflects the discussion in the previous interim meeting. Comments and suggestions (especially on section 5) are welcome. thank you, kaname nishizuka -------- Forwarded Message -------- Subject: New Version Notification for draft-nishizuka-dots-inter-domain-usecases-02.txt Date: Mon, 19 Sep 2016 18:39:54 -0700 From: internet-drafts@ietf.org To: Kaname Nishizuka A new version of I-D, draft-nishizuka-dots-inter-domain-usecases-02.txt has been successfully submitted by Kaname Nishizuka and posted to the IETF repository. Name: draft-nishizuka-dots-inter-domain-usecases Revision: 02 Title: Inter-Domain DOTS Use Cases Document date: 2016-09-20 Group: Individual Submission Pages: 24 URL: https://www.ietf.org/internet-drafts/draft-nishizuka-dots-inter-domain-usecases-02.txt Status: https://datatracker.ietf.org/doc/draft-nishizuka-dots-inter-domain-usecases/ Htmlized: https://tools.ietf.org/html/draft-nishizuka-dots-inter-domain-usecases-02 Diff: https://www.ietf.org/rfcdiff?url2=draft-nishizuka-dots-inter-domain-usecases-02 Abstract: This document describes inter-domain use cases of the DDoS Open Threat Signaling(DOTS). The use cases descirbed in this draft will be merged into [I-D.draft-ietf-dots-use-cases]. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------6FFDEDB32DA5893C771A5F51 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Hi all,

I've just updated my individual usecase draft in order to keep it active status until it will be merged into the WG usecase draft.
The consolidated usecases are described in Section 5 which reflects the discussion in the previous interim meeting.

Comments and suggestions (especially on section 5) are welcome.

thank you,
kaname nishizuka

-------- Forwarded Message --------
Subject: New Version Notification for draft-nishizuka-dots-inter-domain-usecases-02.txt
Date: Mon, 19 Sep 2016 18:39:54 -0700
From: internet-drafts@ietf.org
To: Kaname Nishizuka <kaname@nttv6.jp> 


A new version of I-D, draft-nishizuka-dots-inter-domain-usecases-02.txt
has been successfully submitted by Kaname Nishizuka and posted to the
IETF repository.

Name:		draft-nishizuka-dots-inter-domain-usecases
Revision:	02
Title:		Inter-Domain DOTS Use Cases
Document date:	2016-09-20
Group:		Individual Submission
Pages:		24
URL:            https://www.ietf.org/internet-drafts/draft-nishizuka-dots-inter-domain-usecases-02.txt
Status:         https://datatracker.ietf.org/doc/draft-nishizuka-dots-inter-domain-usecases/
Htmlized:       https://tools.ietf.org/html/draft-nishizuka-dots-inter-domain-usecases-02
Diff:           https://www.ietf.org/rfcdiff?url2=draft-nishizuka-dots-inter-domain-usecases-02

Abstract:
   This document describes inter-domain use cases of the DDoS Open
   Threat Signaling(DOTS).  The use cases descirbed in this draft will
   be merged into [I-D.draft-ietf-dots-use-cases].

                                                                                  


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat
--------------6FFDEDB32DA5893C771A5F51-- From nobody Wed Sep 21 07:11:26 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C6AA12B339 for ; Wed, 21 Sep 2016 07:11:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 78OPapahBeTC for ; Wed, 21 Sep 2016 07:11:23 -0700 (PDT) Received: from shetland.sei.cmu.edu (shetland.sei.cmu.edu [192.58.107.44]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCB9612B2F5 for ; Wed, 21 Sep 2016 07:10:04 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by shetland.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u8LEA3Nu017598 for ; Wed, 21 Sep 2016 10:10:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1474467003; bh=S7x0jig2dUQXCiQ6YqLDRn/jyp0cR5lvQDDlWpTthrc=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version:Sender:Reply-To:Cc: In-Reply-To:References; b=hG1sYaiSRfSAlTbYRvt/zbfMTlB7cayTIGC78xxOwTw+M+8kpsaIkJN/8Y0Oq8B5A dfL3WqNhC9IKPXZhBH8lRKeEiBlEtzMAB68bGklXLUAuPq4YP3gzIZwpXe++PSlnkV poU2tTe8lVU5/THYi/VnB6IOxRNG7mMB5tF7GM/g= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by timber.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u8LEA2HU011928 for ; Wed, 21 Sep 2016 10:10:02 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASSINA.ad.sei.cmu.edu ([10.64.28.249]) with mapi id 14.03.0301.000; Wed, 21 Sep 2016 10:10:02 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: Reminder: 9/27 Virtual Interim Meeting Thread-Index: AdIUEY5q6BzS9ndxR/a+v5uB9XOkHw== Date: Wed, 21 Sep 2016 14:10:01 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFC0104E516DE@marathon> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Dots] Reminder: 9/27 Virtual Interim Meeting X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Sep 2016 14:11:25 -0000 Hello WG! A reminder, next Tuesday, September 27 we'll be having a virtual interim me= eting. All the details are below. Note that there is still time on the pl= anned agenda. Please join us. =3D=3D[ Date/Time ]=3D=3D Tuesday, September 27, 2016 1400-1530 UTC Converted to local time: ** San Francisco -- 7:00:00 AM PDT UTC-7 hours ** New York -- 10:00:00 AM EDT UTC-4 hours=20 ** UTC -- 2:00:00 PM UTC UTC =20 ** London -- 3:00:00 PM BST UTC+1 hour =20 ** Berlin -- 4:00:00 PM CEST UTC+2 hours ** Bangkok -- 9:00:00 PM ICT UTC+7 hours ** Beijing -- 10:00:00 PM CST UTC+8 hours =3D=3D[ Agenda ]=3D=3D 1. Note well, logistics and introduction (chairs, 5 min) 2. Use Case Discussion - draft-ietf-dots-use-cases-02 (Roland Dobbins, 20 min) - draft-nishizuka-dots-inter-domain-usecases-02=20 (Kaname Nishizuka, 10 min) 3. Data and Information Model(s) (Flemming Andreasen) 4. Protocol drafts - draft-reddy-dots-data-channel-00 (Tiru Reddy, 10 min)=20 - draft-reddy-dots-signal-channel-00 (Tiru Reddy, 10 min) 4. Open Mic (30 min) 5. Closing discussion and way ahead summary (chairs, 5 min) =3D=3D[ WebEx Information ]=3D=3D Meeting URL: https://ietf.webex.com/ietf/j.php?MTID=3Dm84a8c2f46520bfc038867c113c274cfa =20 Meeting number: 646 441 945 Meeting password: kfTN2mvh =20 Dial-in Numbers: 1-877-668-4493 Call-in toll free number (US/Canada) 1-650-479-3208 Call-in toll number (US/Canada)=20 =3D=3D=3D=3D=3D=3D=3D From nobody Wed Sep 21 08:37:52 2016 Return-Path: X-Original-To: dots@ietf.org Delivered-To: dots@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 77AA312B575; Wed, 21 Sep 2016 08:37:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF Announcement List" X-Test-IDTracker: no X-IETF-IDTracker: 6.33.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <147447226744.26532.10284561012526393211.idtracker@ietfa.amsl.com> Date: Wed, 21 Sep 2016 08:37:47 -0700 Archived-At: Cc: dots@ietf.org Subject: [Dots] DDoS Open Threat Signaling (dots) WG Virtual Meeting: 2016-09-27 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Sep 2016 15:37:47 -0000 The DDoS Open Threat Signaling (dots) Working Group will hold a virtual interim meeting on 2016-09-27 from 10:00 to 11:30 America/New_York. Agenda: (No agenda submitted) Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=m84a8c2f46520bfc038867c113c274cfa Meeting number: 646 441 945 Meeting password: kfTN2mvh Dial-in Numbers: 1-877-668-4493 Call-in toll free number (US/Canada) 1-650-479-3208 Call-in toll number (US/Canada) From nobody Sun Sep 25 09:39:35 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08FC6127058 for ; Sun, 25 Sep 2016 09:39:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7tG6UNy_eZrn for ; Sun, 25 Sep 2016 09:39:32 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A76B01200DF for ; Sun, 25 Sep 2016 09:39:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=732; q=dns/txt; s=iport; t=1474821572; x=1476031172; h=to:from:subject:message-id:date:mime-version: content-transfer-encoding; bh=kjRkZpjQkXJ8NFI/znrLEE+9zz6RH278J6LFo0AhVPs=; b=mO4jhqGhAVh3pSR5mONOL05pzx4ElNUEVl6Qf6HlnLbv/+v/YGIwaG28 XEikltKxhrILdNgr+2e0OxWJ5hN2ZlUG03WUW9aIzaCfSxdNVIYutNzS4 Bwpn4dbNPOt8y5OEG/NwgoRNg5yyRadEhJcQyh/OWEY6lSdf8TKhJKi62 U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AlCADJ/OdX/5xdJa1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgzsBAQEBAR6BAbdEgg+CBIdaOhIBAgEBAQEBAQFeJ4ULFXYCJgJfDQg?= =?us-ascii?q?BAYhHoUuPZoxGAQEBBwIBJIEGhTGBfIQUgnKDGoJaAQSZdo9oiWaGBZBnJAEvg?= =?us-ascii?q?yaBeyKHMwEBAQ?= X-IronPort-AV: E=Sophos;i="5.30,394,1470700800"; d="scan'208";a="152827780" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Sep 2016 16:39:32 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id u8PGdVhZ029323 for ; Sun, 25 Sep 2016 16:39:31 GMT To: dots From: Flemming Andreasen Message-ID: Date: Sun, 25 Sep 2016 12:39:31 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Sep 2016 16:39:34 -0000 Requirement DATA-003 (Session configuration), which deals with the data channel requirement, include the following: DOTS server implementations MUST have mechanisms to configure the following: * Acceptable signal lossiness, as described in GEN-002. * Heartbeat intervals, as described in OP-002. * Maximum mitigation lifetime, as described in OP-005. * Resource identifiers, as described in OP-006. Resource identifier config makes sense to me, but why aren't the first 3 simply part of the signal channel establishment procedure (which would have the added benefit of allowing them to be adjusted more easily later on) ? Thanks -- Flemming From nobody Sun Sep 25 20:30:29 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5ED112B067 for ; Sun, 25 Sep 2016 20:30:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=arbor.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rpRuqCTvTJRU for ; Sun, 25 Sep 2016 20:30:26 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0123.outbound.protection.outlook.com [104.47.34.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62F2612B040 for ; Sun, 25 Sep 2016 20:30:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wxB+MZ9hq2Sqo/Vl0s3mZLJl2yJ93C04SpUA1XkXoVE=; b=TcQOCiRLxkEYzXyleceYTNXqxzxImBRrhwNfht5Z7F3ftcOCCLT3JBHffvKxtxhSil/D+jC+xzY3LPhBdPnRGYFNhuFg9s7vQofVWXkyf0D7WVbJfDOa36Ypdv0zw4P9gtAcsPfmpDUdB0/XzNJZcxg0IAppdewnbxaepBDcwGY= Received: from BL2PR01MB1777.prod.exchangelabs.com (10.167.95.11) by BL2PR01MB1779.prod.exchangelabs.com (10.167.95.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.639.5; Mon, 26 Sep 2016 03:30:23 +0000 Received: from BL2PR01MB1777.prod.exchangelabs.com ([10.167.95.11]) by BL2PR01MB1777.prod.exchangelabs.com ([10.167.95.11]) with mapi id 15.01.0639.006; Mon, 26 Sep 2016 03:30:23 +0000 From: "Mortensen, Andrew" To: Flemming Andreasen Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0toYkb6qeawJEeODDKRZPHajqCLHgkA Date: Mon, 26 Sep 2016 03:30:22 +0000 Message-ID: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=amortensen@arbor.net; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [68.49.167.203] x-ms-office365-filtering-correlation-id: 2c7ab3d7-1d44-46f4-fb30-08d3e5bd731d x-microsoft-exchange-diagnostics: 1; BL2PR01MB1779; 6:XYHT2Qp/MYYF804n44nX0tRXd+S5EJW87G+hpGh4WMu7Pxr56ujZwuzT2KWTK40+IhwF1bWOUxeyNrww0POr/7BPIkUONQyvT7V5Km+ADAdRVd//ejqB/lTr8MnpnQQeNbkma7YiKMz6svXSDUDuKgADuVurlyTZnkWAnj8t3Q5oc33xnw81jvbiZYcz0N8bUgnPaiGaFeI8+SbGTOvX1ZPcb4vAY8ped9iF1FgJTU7LDaH2xSI4QFt9MctxTpQkQ+GtCnC7b0LdtzupoURMqTchoFEIVA8YrbzZw5fUFaoou0B36kdD2Sg+9D/9XTBK; 5:bKHslj7Jxbozlhd2pV7jV9LesP/SNMiYFEvcihwKKt2Tryitzth0fxZgnb9VUQsGIgxXT8thD1NWv5G6y/KHy6JTvf1Sc/ruVFzWFo7U2X8+fm0xeQBG3k8fRUFwYg+v1zsEusppuwtvzb6NfH25cg==; 24:lZTyEnQSVScM52OFyEziQBqNGLs/91Uqhl0z0gl8mMPVBSdOwgQMiAd8i+XDkGPvjX8zSdr+c5p1DFzy/JiRR3z7ZnTtLai7nCYlYQ/rFjM=; 7:0h39vURivI8fpidli3//X74DAlvxjsxukbO+bXk9one4NGXjzBcj1HPkpT2EFFtUFLpiGtHDvznTG4clj9b1LA5uwckBBjKbf2JebHtlPia5mVn1lQx5B2ABSF/NZguP1pUWcQDV+LReHLMuBq4ewBUgvMTfPJvR/nsCVmucOc+UQo45csUPezDuYBvCx2PzBKAer/lne+ZKm17o/pPdlu8F7/lCk/4QPK25miPuii3yvwWEUf5cP/fGrody6XcSLemJ491U0HfzFkSp+ZUy6NeQ5mAqVQ15BUXfCTCjOYBDc+XnPXgl53PCEEKE8gZR x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BL2PR01MB1779; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(95692535739014); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040176)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6042046)(6043046); SRVR:BL2PR01MB1779; BCL:0; PCL:0; RULEID:; SRVR:BL2PR01MB1779; x-forefront-prvs: 00770C4423 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(199003)(189002)(24454002)(51914003)(377454003)(82746002)(2906002)(83716003)(5002640100001)(7846002)(4326007)(92566002)(189998001)(3660700001)(11100500001)(8936002)(3280700002)(68736007)(86362001)(6916009)(8676002)(3846002)(7736002)(66066001)(81166006)(97736004)(87936001)(305945005)(6116002)(81156014)(586003)(102836003)(106356001)(77096005)(105586002)(5660300001)(110136003)(19580395003)(106116001)(101416001)(2900100001)(50986999)(76176999)(122556002)(19580405001)(10400500002)(33656002)(2950100002)(54356999)(36756003)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:BL2PR01MB1779; H:BL2PR01MB1777.prod.exchangelabs.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: arbor.net does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-ID: <488713A8C377FC4CB64502155FBD1081@prod.exchangelabs.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arbor.net X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Sep 2016 03:30:22.8783 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 54f11205-d4aa-4809-bd36-0b542199c5b2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2PR01MB1779 Archived-At: Cc: dots Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 03:30:29 -0000 Thanks for the question. See inline below. > On Sep 25, 2016, at 12:39 PM, Flemming Andreasen wro= te: >=20 > Requirement DATA-003 (Session configuration), which deals with the data c= hannel requirement, include the following: > > DOTS server > implementations MUST have mechanisms to configure the following: >=20 > * Acceptable signal lossiness, as described in GEN-002. >=20 > * Heartbeat intervals, as described in OP-002. >=20 > * Maximum mitigation lifetime, as described in OP-005. >=20 > * Resource identifiers, as described in OP-006. > >=20 > Resource identifier config makes sense to me, but why aren't the first 3 = simply part of the signal channel establishment procedure (which would have= the added benefit of allowing them to be adjusted more easily later on) ? I agree, the first three do seem like good parameters to include when estab= lishing the signal channel. I had been thinking of them as global parameter= s affecting all signal channels established by the DOTS client. In moving them to the signal channel we should also define how the server h= andles invalid values for any of the three. Should the server simply refuse= to establish the session, or fall back to protocol-defined defaults? andrew= From nobody Mon Sep 26 02:16:44 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AECD12B071 for ; Mon, 26 Sep 2016 02:16:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7k0zeMP8PJun for ; Mon, 26 Sep 2016 02:16:41 -0700 (PDT) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D27A12B0A6 for ; Mon, 26 Sep 2016 02:16:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1794; q=dns/txt; s=iport; t=1474881401; x=1476091001; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=69Zx0mAfdkBNIHpWCWcjSn7hzAFdtQqZ1bW8fc83AQQ=; b=S/m5BsmXoNW4+9gPYOjj5ZFFgL7pD23YZzFl3fWO4fXe8JdBfkLktm3D aQadFxs7M6YfpTtBOE7g7CsOW7Y7brQTOJeg8SRZPD3QjASxK3s/IGEL9 kbJnR/sfulv67o0oatF51+5wTuNpLibMdNgNYpA+PMobMxEoWNzDZKXyN Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ByAQA55uhX/5RdJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgzsBAQEBAR5XfAeNLKtOggQZC4V6AoFJOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwEBAQE3NBcEAgEIEQQBAR8JBycLFAkIAgQBEgiIOwgOvW0BAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEXBYY3hFSBPIJyhXQFmXYBj2CPcoxrg3sBHjaFBXKGfH8?= =?us-ascii?q?BAQE?= X-IronPort-AV: E=Sophos;i="5.30,398,1470700800"; d="scan'208";a="151188408" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2016 09:16:40 +0000 Received: from XCH-ALN-003.cisco.com (xch-aln-003.cisco.com [173.36.7.13]) by rcdn-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id u8Q9GeIj024290 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Mon, 26 Sep 2016 09:16:40 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-ALN-003.cisco.com (173.36.7.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 26 Sep 2016 04:16:40 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Mon, 26 Sep 2016 04:16:39 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Flemming Andreasen (fandreas)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLeGWw Date: Mon, 26 Sep 2016 09:16:39 +0000 Message-ID: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.142.108.240] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 09:16:43 -0000 > -----Original Message----- > From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming Andreasen > (fandreas) > Sent: Sunday, September 25, 2016 10:10 PM > To: dots > Subject: [Dots] DOTS Requirements: DATA-003 Session configuration >=20 > Requirement DATA-003 (Session configuration), which deals with the data > channel requirement, include the following: > > DOTS server > implementations MUST have mechanisms to configure the following: >=20 > * Acceptable signal lossiness, as described in GEN-002. >=20 > * Heartbeat intervals, as described in OP-002. >=20 > * Maximum mitigation lifetime, as described in OP-005. >=20 > * Resource identifiers, as described in OP-006. > >=20 > Resource identifier config makes sense to me, but why aren't the first 3 = simply > part of the signal channel establishment procedure (which would have the > added benefit of allowing them to be adjusted more easily later > on) ? Acceptable signal lossiness configuration helps determine the lossiness par= ameters (e.g. max number of re-transmissions, max re-transmission parameter= s etc.) for the first DOTS signal message. The first DOTS signal message ma= y convey new signal lossiness configuration parameters for subsequent DOTS = signal messages. Heartbeat intervals and Maximum mitigation lifetime configuration in DOTS d= ata channel can be treated as global configuration used for all DOTS signal= channels b/w DOTS agents, unless specifically over-written by the DOTS sig= nal channel. -Tiru >=20 > Thanks >=20 > -- Flemming >=20 > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Mon Sep 26 02:20:01 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 726DF12B0BE for ; Mon, 26 Sep 2016 02:20:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X9KwUNIRQqke for ; Mon, 26 Sep 2016 02:19:58 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD01B12B071 for ; Mon, 26 Sep 2016 02:19:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2094; q=dns/txt; s=iport; t=1474881598; x=1476091198; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=folbJCrBQsoM0wd2LTcijopSag4IOke7yWWa1tITWmE=; b=SPrWsMuo1BTacXYrU9NMexMi3bq/Q+swMZG9/+EbNwvEZcolKlpNCtGT GReD5npNCDLxVPB0rZETm9rzBl/GbBKdCMIdZwg/3ZSwrPNwQ0KhnWSby m3sIdNxA06MJHGIOlnbbr3Yxo63nuAaR3p0RlYPs75omknDlJZc0Si0r0 w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ByAQCm5+hX/4YNJK1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgzsBAQEBAR5XfAeNLKtOggQZC4V6AoFKOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwEBAQE3NAsMBAIBCBEEAQEBHgkHJwsUCQgCBAENBQiIOwgOvW8BAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEXBYY3hFSBPIJyhXQFmXYBj2CPcoxrg3sBHjaFBXK?= =?us-ascii?q?GfH8BAQE?= X-IronPort-AV: E=Sophos;i="5.30,398,1470700800"; d="scan'208";a="327969072" Received: from alln-core-12.cisco.com ([173.36.13.134]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 26 Sep 2016 09:19:57 +0000 Received: from XCH-ALN-004.cisco.com (xch-aln-004.cisco.com [173.36.7.14]) by alln-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id u8Q9Jvd1009082 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 26 Sep 2016 09:19:57 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-ALN-004.cisco.com (173.36.7.14) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 26 Sep 2016 04:19:57 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Mon, 26 Sep 2016 04:19:57 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Mortensen, Andrew" , "Flemming Andreasen (fandreas)" Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLcdoAgAAM/bA= Date: Mon, 26 Sep 2016 09:19:57 +0000 Message-ID: References: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> In-Reply-To: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.142.108.240] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: dots Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 09:20:00 -0000 > -----Original Message----- > From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Mortensen, Andrew > Sent: Monday, September 26, 2016 9:00 AM > To: Flemming Andreasen (fandreas) > Cc: dots > Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >=20 > Thanks for the question. See inline below. >=20 > > On Sep 25, 2016, at 12:39 PM, Flemming Andreasen > wrote: > > > > Requirement DATA-003 (Session configuration), which deals with the data > channel requirement, include the following: > > > > DOTS server > > implementations MUST have mechanisms to configure the following: > > > > * Acceptable signal lossiness, as described in GEN-002. > > > > * Heartbeat intervals, as described in OP-002. > > > > * Maximum mitigation lifetime, as described in OP-005. > > > > * Resource identifiers, as described in OP-006. > > > > > > Resource identifier config makes sense to me, but why aren't the first = 3 > simply part of the signal channel establishment procedure (which would ha= ve > the added benefit of allowing them to be adjusted more easily later on) ? >=20 > I agree, the first three do seem like good parameters to include when > establishing the signal channel. I had been thinking of them as global > parameters affecting all signal channels established by the DOTS client. I think it's useful to signal them in the DOTS data channel. >=20 > In moving them to the signal channel we should also define how the server > handles invalid values for any of the three. Should the server simply ref= use to > establish the session, or fall back to protocol-defined defaults ? Server should only refuse the configuration request but continue to establi= sh the session and process other requests from the client and continue to u= se the default values. -Tiru >=20 > andrew > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Mon Sep 26 09:59:28 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 761B712B30C for ; Mon, 26 Sep 2016 09:59:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kWMWw_gkE1Be for ; Mon, 26 Sep 2016 09:59:24 -0700 (PDT) Received: from shetland.sei.cmu.edu (shetland.sei.cmu.edu [192.58.107.44]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8646F12B24B for ; Mon, 26 Sep 2016 09:59:24 -0700 (PDT) Received: from timber.sei.cmu.edu (timber.sei.cmu.edu [10.64.21.23]) by shetland.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u8QGxNNn008776 for ; Mon, 26 Sep 2016 12:59:23 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cert.org; s=jthatj15xw2j; t=1474909163; bh=DMMn32sb2Otf3hmeCCxM51uhYyudddRbgrLWQyyMwKI=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version:Sender:Reply-To:Cc: In-Reply-To:References; b=muZ2aNp4LAIev6xA7DfW3baDfSAL+UcJHp3x+7GxEY6hwUomr9UDG8pva0rwHNt0m L9JPWJqZCvTRsjbwsXlc+MmFHxFZfh+L1MMnZKU1PIluTPN0FsWhQuSsHB0XCuIQZS mmjEwEpbh6QIxyZIW43rVPQDmbOaJ44UPoL41VlM= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by timber.sei.cmu.edu (8.14.4/8.14.4/1543) with ESMTP id u8QGxHC8029619 for ; Mon, 26 Sep 2016 12:59:17 -0400 Received: from MARATHON.ad.sei.cmu.edu ([10.64.28.250]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0279.002; Mon, 26 Sep 2016 12:59:16 -0400 From: "Roman D. Danyliw" To: "dots@ietf.org" Thread-Topic: Meeting materials for the 9/27 DOTS Virtual Interim Meeting Thread-Index: AdIYFzUwMCoMRUspRLelkY/soltCyg== Date: Mon, 26 Sep 2016 16:59:15 +0000 Message-ID: <359EC4B99E040048A7131E0F4E113AFC0104E552EB@marathon> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.22.6] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Dots] Meeting materials for the 9/27 DOTS Virtual Interim Meeting X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 16:59:26 -0000 Hello! A reminder that tomorrow, Tuesday, September 27th at 1400-1530 UTC we'll be= having a virtual interim meeting. The meeting materials can be downloaded= from here: https://datatracker.ietf.org/meeting/interim-2016-dots-02/sessi= on/dots. The following is the latest agenda: https://www.ietf.org/proceedings/interim-2016-dots-02/agenda/agenda-interim= -2016-dots-02-02 The dial-in information remains the same: https://ietf.webex.com/ietf/j.php?MTID=3Dm84a8c2f46520bfc038867c113c274cfa =20 Meeting number: 646 441 945 Meeting password: kfTN2mvh =20 Dial-in Numbers: 1-877-668-4493 Call-in toll free number (US/Canada) 1-650-479-3208 Call-in toll number (US/Canada)=20 Regards, Roman From nobody Mon Sep 26 11:11:46 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AC8D12B2D0 for ; Mon, 26 Sep 2016 11:11:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0nlBYSwBQrPN for ; Mon, 26 Sep 2016 11:11:44 -0700 (PDT) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA62D12B1DF for ; Mon, 26 Sep 2016 11:11:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1564; q=dns/txt; s=iport; t=1474913503; x=1476123103; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=cmdWFIF742BW1ii7vn5srkS5PXr0k6nDhiAlquHyx88=; b=auWHQeOW8ywE3GfiyqtO9phgpJf3D4J1w2pkQrHJBqX2x49a1LzH1hOy RCpd9I4Kk4Eh6fsmFVI0W+jzfsQe8EnTrmNSHy/+ZLJECl+HupW+iiPQN rCdGoL8749f6FLztuzN1Wi4UpvRMkKbo2/P1dF/jPxvezbEDRMvSxWn1p 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DfAgBQZOlX/5pdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgz0BAQEBAR6BAVKNM6lAgg+CBIYeAoFfOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwE4QQULCxguVwYNBgIBAYg/CL8JAQEBAQEBAQEBAQEBAQEBAQEghjeBf?= =?us-ascii?q?IJYgTyCcoV0AQSZdo9oiWaGBYxrg3weNoMmgXsiNIdmAQEB?= X-IronPort-AV: E=Sophos;i="5.30,400,1470700800"; d="scan'208";a="327492404" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2016 18:11:43 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id u8QIBgv2006221; Mon, 26 Sep 2016 18:11:42 GMT To: "Mortensen, Andrew" References: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> From: Flemming Andreasen Message-ID: <091c009e-82a4-a906-8d13-63fe0437161e@cisco.com> Date: Mon, 26 Sep 2016 14:11:42 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: dots Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 18:11:45 -0000 On 9/25/16 11:30 PM, Mortensen, Andrew wrote: > Thanks for the question. See inline below. > >> On Sep 25, 2016, at 12:39 PM, Flemming Andreasen wrote: >> >> Requirement DATA-003 (Session configuration), which deals with the data channel requirement, include the following: >> >> DOTS server >> implementations MUST have mechanisms to configure the following: >> >> * Acceptable signal lossiness, as described in GEN-002. >> >> * Heartbeat intervals, as described in OP-002. >> >> * Maximum mitigation lifetime, as described in OP-005. >> >> * Resource identifiers, as described in OP-006. >> >> >> Resource identifier config makes sense to me, but why aren't the first 3 simply part of the signal channel establishment procedure (which would have the added benefit of allowing them to be adjusted more easily later on) ? > I agree, the first three do seem like good parameters to include when establishing the signal channel. I had been thinking of them as global parameters affecting all signal channels established by the DOTS client. > > In moving them to the signal channel we should also define how the server handles invalid values for any of the three. Should the server simply refuse to establish the session, or fall back to protocol-defined defaults? Either that, or the server can pick the closests values it supports and tell the client about those. If the client doesn't like those, it can always end the session. -- Flemming > andrew. > From nobody Mon Sep 26 11:13:22 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4526712B0A6 for ; Mon, 26 Sep 2016 11:13:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QB1TvC1aYSbi for ; Mon, 26 Sep 2016 11:13:19 -0700 (PDT) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46BE112B2AF for ; Mon, 26 Sep 2016 11:13:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2274; q=dns/txt; s=iport; t=1474913599; x=1476123199; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=j/CulBuq2vm/yADp9FD3ORcrDj5Mtjjo9fCPK5fRwaY=; b=OGPKKeMBJP8s7sVQnmmGH1cAEd7ULh0+cE+ARVkvbFdSu3D7T+a9DEBd JWMjPC8Yrf9S0kznjrcac/Y+NgZ/I4wbmpzAy+qU8rIhRU+VO4nah2fOR zhFO7G9pQocPwOxP76fEkT1lFsRKiXeSKEIFzS+LtD1San+ZwKbcm2E10 w=; X-IronPort-AV: E=Sophos;i="5.30,400,1470700800"; d="scan'208";a="326817329" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2016 18:13:18 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id u8QIDIIh025400; Mon, 26 Sep 2016 18:13:18 GMT To: "Tirumaleswar Reddy (tireddy)" , "Mortensen, Andrew" References: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> From: Flemming Andreasen Message-ID: <02f15a66-0f92-d9e9-cc4b-578109ddcbe0@cisco.com> Date: Mon, 26 Sep 2016 14:13:17 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: dots Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 18:13:21 -0000 On 9/26/16 5:19 AM, Tirumaleswar Reddy (tireddy) wrote: >> -----Original Message----- >> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Mortensen, Andrew >> Sent: Monday, September 26, 2016 9:00 AM >> To: Flemming Andreasen (fandreas) >> Cc: dots >> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >> >> Thanks for the question. See inline below. >> >>> On Sep 25, 2016, at 12:39 PM, Flemming Andreasen >> wrote: >>> Requirement DATA-003 (Session configuration), which deals with the data >> channel requirement, include the following: >>> >>> DOTS server >>> implementations MUST have mechanisms to configure the following: >>> >>> * Acceptable signal lossiness, as described in GEN-002. >>> >>> * Heartbeat intervals, as described in OP-002. >>> >>> * Maximum mitigation lifetime, as described in OP-005. >>> >>> * Resource identifiers, as described in OP-006. >>> >>> >>> Resource identifier config makes sense to me, but why aren't the first 3 >> simply part of the signal channel establishment procedure (which would have >> the added benefit of allowing them to be adjusted more easily later on) ? >> >> I agree, the first three do seem like good parameters to include when >> establishing the signal channel. I had been thinking of them as global >> parameters affecting all signal channels established by the DOTS client. > I think it's useful to signal them in the DOTS data channel. > >> In moving them to the signal channel we should also define how the server >> handles invalid values for any of the three. Should the server simply refuse to >> establish the session, or fall back to protocol-defined defaults ? > Server should only refuse the configuration request but continue to establish the session and process other requests from the client and continue to use the default values. I'm not sure what that means - do you assume there is a separate config requests here ? Thanks -- Flemming > -Tiru > >> andrew >> _______________________________________________ >> Dots mailing list >> Dots@ietf.org >> https://www.ietf.org/mailman/listinfo/dots > . > From nobody Mon Sep 26 11:15:54 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D804112B2AF for ; Mon, 26 Sep 2016 11:15:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.838 X-Spam-Level: X-Spam-Status: No, score=-16.838 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dpmvVG9YHQ2I for ; Mon, 26 Sep 2016 11:15:51 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E570112B1DF for ; Mon, 26 Sep 2016 11:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1989; q=dns/txt; s=iport; t=1474913751; x=1476123351; h=subject:to:references:from:message-id:date:mime-version: in-reply-to:content-transfer-encoding; bh=CkTIuzP7OIwQCVbjRFLpMUuyFDbQqHQvjBee10EWzOc=; b=kYbTmeIwQ6f1TqU7Ib3/UAxu70iP/j6aqZCHak1dfn4UkAB2cYLiEC1a Ak+bV00X5BPfbweEW7TNPhGEldeKz4pQ1riXBDl+exruXAKorbgUfIaRW r4563CYuRoJZNCx10PZ/HNTC9nvoTblglRDcw5P4vwfe/IAzI0Ya7xjGF c=; X-IronPort-AV: E=Sophos;i="5.30,400,1470700800"; d="scan'208";a="328392682" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2016 18:15:50 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-11.cisco.com (8.14.5/8.14.5) with ESMTP id u8QIFnP7011505; Mon, 26 Sep 2016 18:15:50 GMT To: "Tirumaleswar Reddy (tireddy)" , dots References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> From: Flemming Andreasen Message-ID: <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> Date: Mon, 26 Sep 2016 14:15:49 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 18:15:53 -0000 On 9/26/16 5:16 AM, Tirumaleswar Reddy (tireddy) wrote: >> -----Original Message----- >> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming Andreasen >> (fandreas) >> Sent: Sunday, September 25, 2016 10:10 PM >> To: dots >> Subject: [Dots] DOTS Requirements: DATA-003 Session configuration >> >> Requirement DATA-003 (Session configuration), which deals with the data >> channel requirement, include the following: >> >> DOTS server >> implementations MUST have mechanisms to configure the following: >> >> * Acceptable signal lossiness, as described in GEN-002. >> >> * Heartbeat intervals, as described in OP-002. >> >> * Maximum mitigation lifetime, as described in OP-005. >> >> * Resource identifiers, as described in OP-006. >> >> >> Resource identifier config makes sense to me, but why aren't the first 3 simply >> part of the signal channel establishment procedure (which would have the >> added benefit of allowing them to be adjusted more easily later >> on) ? > Acceptable signal lossiness configuration helps determine the lossiness parameters (e.g. max number of re-transmissions, max re-transmission parameters etc.) for the first DOTS signal message. The first DOTS signal message may convey new signal lossiness configuration parameters for subsequent DOTS signal messages. > > Heartbeat intervals and Maximum mitigation lifetime configuration in DOTS data channel can be treated as global configuration used for all DOTS signal channels b/w DOTS agents, unless specifically over-written by the DOTS signal channel. Seems like more complexity than needed - I'd just have one set of values in the protocol (signal channel). Thanks -- Flemming > -Tiru > >> Thanks >> >> -- Flemming >> >> _______________________________________________ >> Dots mailing list >> Dots@ietf.org >> https://www.ietf.org/mailman/listinfo/dots > . > From nobody Mon Sep 26 13:43:33 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67B7012B029; Mon, 26 Sep 2016 13:43:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.838 X-Spam-Level: X-Spam-Status: No, score=-16.838 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aEAbeLUfgHbw; Mon, 26 Sep 2016 13:43:29 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 988A912B01C; Mon, 26 Sep 2016 13:43:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=946; q=dns/txt; s=iport; t=1474922609; x=1476132209; h=from:subject:to:cc:message-id:date:mime-version: content-transfer-encoding; bh=PJqAVn20mMS9UCL3dTTGb4CfH3Em3RnpowGJZKkHFNI=; b=m2f+t3s8MVXqec1q9AELTplfMueLUjuSeoCJ1mQE/xoGfmtBhreyMjfB TX2BRtgal6VhZ0wa9JapTW9hUAs2zZqAOpdD0+vRHKO2i2MO+NjqEmdGL OGofGl3itlsVHJ+MaK1WMPJdC8HsATTQatbV7eSVooMj3lMTcleJscO9m U=; X-IronPort-AV: E=Sophos;i="5.30,401,1470700800"; d="scan'208";a="156887759" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2016 20:43:28 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id u8QKhScc017817; Mon, 26 Sep 2016 20:43:28 GMT From: Flemming Andreasen To: dots Message-ID: Date: Mon, 26 Sep 2016 16:43:28 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: dots-chairs@ietf.org, "'Tirumaleswar Reddy \(tireddy\)'" Subject: [Dots] DOTS Information and Data Model X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2016 20:43:31 -0000 Greetings As promised during the Berlin meeting, Tiru and I just submitted a -00 (and very much work in progress) document for the DOTS Information and Data Model - we will use this as the basis for the discussion in the virtual interim meeting Tuesday: https://datatracker.ietf.org/doc/draft-andreasen-dots-info-data-model/ The focus in this version has been on identifying a (high-level) set of logical messages and information elements that seem to be needed based on the DOTS requirements, DOTS use cases (WG adopted use case doc only for now), and DOTS architecture. For now, we have purposely not said anything about the particular protocol to be used or anything else related to "wire formats". Expected next steps will be to drill down further on the details of both the messages and information elements and of course to get feedback on what is currently suggested in here. Thanks -- Flemming From nobody Mon Sep 26 21:16:15 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA27112B040 for ; Mon, 26 Sep 2016 21:16:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D1IY7vp84Enc for ; Mon, 26 Sep 2016 21:16:12 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E7A812B275 for ; Mon, 26 Sep 2016 21:16:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2917; q=dns/txt; s=iport; t=1474949772; x=1476159372; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=/mdklwx6pVOARk/eSofJVn2j14vlDtc3z/+GTzjFOVQ=; b=MXYoGkRtcSZXuNvRI4A7PRhKHXAbF/HDDTnoDILI/WXGCIBuGoMq1vLj 5h46lVy2A86SKIJ/XjOEYse8jMT35pGcdff6eNiBXPTqfgMqWPuwaqpB4 MJOcIcizrH9lHdFxicA3/rgr0QCq5Nn8cp/bbblUzthbBvLlv2T+9ZJRK A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CkAQDi8elX/4kNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgz0BAQEBAR5XfAeNLKtPggQZC4V6AoFiOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwEBAQE3NAsMBAIBCBEEAQEBHgkHJwsUCQgCBA4FCIg7CA7ACQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBARcFhjeEVIE8gnKFdAWZdgGPYo9yjGuDewEeNoUFcoZ?= =?us-ascii?q?gfwEBAQ?= X-IronPort-AV: E=Sophos;i="5.30,403,1470700800"; d="scan'208";a="328428619" Received: from alln-core-4.cisco.com ([173.36.13.137]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Sep 2016 04:16:11 +0000 Received: from XCH-ALN-001.cisco.com (xch-aln-001.cisco.com [173.36.7.11]) by alln-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id u8R4GBIN003342 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 27 Sep 2016 04:16:11 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-ALN-001.cisco.com (173.36.7.11) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 26 Sep 2016 23:16:10 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Mon, 26 Sep 2016 23:16:10 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Flemming Andreasen (fandreas)" , "Mortensen, Andrew" Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLcdoAgAAM/bCAAOmygIAAUgWA Date: Tue, 27 Sep 2016 04:16:10 +0000 Message-ID: <362b28a09b35441d98ee789a46134a8f@XCH-RCD-017.cisco.com> References: <5AE358A7-9ECE-4581-9E56-274E73B2900C@arbor.net> <02f15a66-0f92-d9e9-cc4b-578109ddcbe0@cisco.com> In-Reply-To: <02f15a66-0f92-d9e9-cc4b-578109ddcbe0@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.142.108.134] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: dots Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 04:16:14 -0000 > -----Original Message----- > From: Flemming Andreasen (fandreas) > Sent: Monday, September 26, 2016 11:43 PM > To: Tirumaleswar Reddy (tireddy) ; Mortensen, Andrew > > Cc: dots > Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >=20 >=20 >=20 > On 9/26/16 5:19 AM, Tirumaleswar Reddy (tireddy) wrote: > >> -----Original Message----- > >> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Mortensen, > >> Andrew > >> Sent: Monday, September 26, 2016 9:00 AM > >> To: Flemming Andreasen (fandreas) > >> Cc: dots > >> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration > >> > >> Thanks for the question. See inline below. > >> > >>> On Sep 25, 2016, at 12:39 PM, Flemming Andreasen > >>> > >> wrote: > >>> Requirement DATA-003 (Session configuration), which deals with the > >>> data > >> channel requirement, include the following: > >>> > >>> DOTS server > >>> implementations MUST have mechanisms to configure the following= : > >>> > >>> * Acceptable signal lossiness, as described in GEN-002. > >>> > >>> * Heartbeat intervals, as described in OP-002. > >>> > >>> * Maximum mitigation lifetime, as described in OP-005. > >>> > >>> * Resource identifiers, as described in OP-006. > >>> > >>> > >>> Resource identifier config makes sense to me, but why aren't the > >>> first 3 > >> simply part of the signal channel establishment procedure (which > >> would have the added benefit of allowing them to be adjusted more easi= ly > later on) ? > >> > >> I agree, the first three do seem like good parameters to include when > >> establishing the signal channel. I had been thinking of them as > >> global parameters affecting all signal channels established by the DOT= S > client. > > I think it's useful to signal them in the DOTS data channel. > > > >> In moving them to the signal channel we should also define how the > >> server handles invalid values for any of the three. Should the server > >> simply refuse to establish the session, or fall back to protocol-defin= ed > defaults ? > > Server should only refuse the configuration request but continue to est= ablish > the session and process other requests from the client and continue to us= e the > default values. > I'm not sure what that means - do you assume there is a separate config > requests here ? Yes, use separate requests for signaling possible DDoS attack and signal ch= annel configuration to the DOTS server. -Tiru >=20 > Thanks >=20 > -- Flemming >=20 >=20 > > -Tiru > > > >> andrew > >> _______________________________________________ > >> Dots mailing list > >> Dots@ietf.org > >> https://www.ietf.org/mailman/listinfo/dots > > . > > From nobody Mon Sep 26 21:32:56 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A758B12B3D2 for ; Mon, 26 Sep 2016 21:32:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lvDi2uRgHJWv for ; Mon, 26 Sep 2016 21:32:53 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E92212B040 for ; Mon, 26 Sep 2016 21:24:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2632; q=dns/txt; s=iport; t=1474950268; x=1476159868; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=dItcq8NInZEUhOmSxrZ7AU0AaXHv/bLkMvf8vNRDqv4=; b=W69TolRk9oGGL6tBwapKdNdAuPSkvacHpNQ5Kt848m3B1yonUI2mGh8L C2IAXeZmw/66qkqisjJlbfciToJkYXOEhwvPm1I8vzYDjuerOvhf5hFF7 Ya91XiS4mtZBt9Ky3tiLIUnALt2YfyRvhY2XSpdJKJ4FP7J88AR0bF3eg 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CkAQAE8+lX/4cNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgz0BAQEBAR5XfAeNLKtPggQZC4V6AoFiOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwEBAQE3NBcEAgEIEQQBAQEeCQcnCxQJCAIEARIIiDsIDsAKAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBFwWGN4RUgTyCcoV0BZl2AY9ij3KMa4N7AR42hQVyhmB?= =?us-ascii?q?/AQEB?= X-IronPort-AV: E=Sophos;i="5.30,403,1470700800"; d="scan'208";a="328430358" Received: from alln-core-2.cisco.com ([173.36.13.135]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Sep 2016 04:24:23 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by alln-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id u8R4OM0V027279 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 27 Sep 2016 04:24:23 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 26 Sep 2016 23:24:22 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Mon, 26 Sep 2016 23:24:22 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Flemming Andreasen (fandreas)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLeGWwgADw2YCAAFQTwA== Date: Tue, 27 Sep 2016 04:24:22 +0000 Message-ID: References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> In-Reply-To: <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.142.108.134] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 04:32:55 -0000 > -----Original Message----- > From: Flemming Andreasen (fandreas) > Sent: Monday, September 26, 2016 11:46 PM > To: Tirumaleswar Reddy (tireddy) ; dots > Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >=20 >=20 >=20 > On 9/26/16 5:16 AM, Tirumaleswar Reddy (tireddy) wrote: > >> -----Original Message----- > >> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming > >> Andreasen > >> (fandreas) > >> Sent: Sunday, September 25, 2016 10:10 PM > >> To: dots > >> Subject: [Dots] DOTS Requirements: DATA-003 Session configuration > >> > >> Requirement DATA-003 (Session configuration), which deals with the > >> data channel requirement, include the following: > >> > >> DOTS server > >> implementations MUST have mechanisms to configure the followin= g: > >> > >> * Acceptable signal lossiness, as described in GEN-002. > >> > >> * Heartbeat intervals, as described in OP-002. > >> > >> * Maximum mitigation lifetime, as described in OP-005. > >> > >> * Resource identifiers, as described in OP-006. > >> > >> > >> Resource identifier config makes sense to me, but why aren't the > >> first 3 simply part of the signal channel establishment procedure > >> (which would have the added benefit of allowing them to be adjusted > >> more easily later > >> on) ? > > Acceptable signal lossiness configuration helps determine the lossiness > parameters (e.g. max number of re-transmissions, max re-transmission > parameters etc.) for the first DOTS signal message. The first DOTS signal > message may convey new signal lossiness configuration parameters for > subsequent DOTS signal messages. > > > > Heartbeat intervals and Maximum mitigation lifetime configuration in DO= TS > data channel can be treated as global configuration used for all DOTS sig= nal > channels b/w DOTS agents, unless specifically over-written by the DOTS si= gnal > channel. > Seems like more complexity than needed - I'd just have one set of values = in > the protocol (signal channel). The advantage of the above approach is: setting the values in data channel = during peace time avoids the need to convey the configuration parameters in= the signal channel during DDoS attack. -Tiru >=20 > Thanks >=20 > -- Flemming >=20 > > -Tiru > > > >> Thanks > >> > >> -- Flemming > >> > >> _______________________________________________ > >> Dots mailing list > >> Dots@ietf.org > >> https://www.ietf.org/mailman/listinfo/dots > > . > > From nobody Tue Sep 27 05:29:19 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92B5912B0F6 for ; Tue, 27 Sep 2016 05:29:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SEYidTXt7d0q for ; Tue, 27 Sep 2016 05:29:16 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCB02124281 for ; Tue, 27 Sep 2016 05:29:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2885; q=dns/txt; s=iport; t=1474979356; x=1476188956; h=subject:to:references:from:message-id:date:mime-version: in-reply-to:content-transfer-encoding; bh=1EEYVlco5RQSiGbF1nsRFzLFgUwIW4qz3l7JXp2OhUs=; b=kxpMrZ1QINxV5uScsODKpmlhSFo41nfJ2HjDHd67sT6o2QzloyNnFsLC dBVGIMpP+R0OcgA7ytdgBME07J8Uk12eUWW+3ZSndr+AkrsZHm2dHgs// M/i7QdraYAoO7V2m1ak4549VuJGF9lcIv0c3agoxAGGIcKkuyL28evJVV o=; X-IronPort-AV: E=Sophos;i="5.30,405,1470700800"; d="scan'208";a="151331492" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Sep 2016 12:29:16 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id u8RCTFhZ001168; Tue, 27 Sep 2016 12:29:15 GMT To: "Tirumaleswar Reddy (tireddy)" , dots References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> From: Flemming Andreasen Message-ID: Date: Tue, 27 Sep 2016 08:29:15 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 12:29:18 -0000 On 9/27/16 12:24 AM, Tirumaleswar Reddy (tireddy) wrote: >> -----Original Message----- >> From: Flemming Andreasen (fandreas) >> Sent: Monday, September 26, 2016 11:46 PM >> To: Tirumaleswar Reddy (tireddy) ; dots >> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >> >> >> >> On 9/26/16 5:16 AM, Tirumaleswar Reddy (tireddy) wrote: >>>> -----Original Message----- >>>> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming >>>> Andreasen >>>> (fandreas) >>>> Sent: Sunday, September 25, 2016 10:10 PM >>>> To: dots >>>> Subject: [Dots] DOTS Requirements: DATA-003 Session configuration >>>> >>>> Requirement DATA-003 (Session configuration), which deals with the >>>> data channel requirement, include the following: >>>> >>>> DOTS server >>>> implementations MUST have mechanisms to configure the following: >>>> >>>> * Acceptable signal lossiness, as described in GEN-002. >>>> >>>> * Heartbeat intervals, as described in OP-002. >>>> >>>> * Maximum mitigation lifetime, as described in OP-005. >>>> >>>> * Resource identifiers, as described in OP-006. >>>> >>>> >>>> Resource identifier config makes sense to me, but why aren't the >>>> first 3 simply part of the signal channel establishment procedure >>>> (which would have the added benefit of allowing them to be adjusted >>>> more easily later >>>> on) ? >>> Acceptable signal lossiness configuration helps determine the lossiness >> parameters (e.g. max number of re-transmissions, max re-transmission >> parameters etc.) for the first DOTS signal message. The first DOTS signal >> message may convey new signal lossiness configuration parameters for >> subsequent DOTS signal messages. >>> Heartbeat intervals and Maximum mitigation lifetime configuration in DOTS >> data channel can be treated as global configuration used for all DOTS signal >> channels b/w DOTS agents, unless specifically over-written by the DOTS signal >> channel. >> Seems like more complexity than needed - I'd just have one set of values in >> the protocol (signal channel). > The advantage of the above approach is: setting the values in data channel during peace time avoids the need to convey the configuration parameters in the signal channel during DDoS attack. You have to establish a bidirectional mutually authenticated signal channel regardless, so at least one message needs to get through - that message can simply set the value. As for having the same data conveyed via multiple avenues, it adds additional complexity and leads to various inconsistency and race condition issues you have to deal with. I'm not in favor of that unless it adds substantial benefits, and I haven't seen those yet. Thanks -- Flemming From nobody Tue Sep 27 05:48:26 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11E4C12B143 for ; Tue, 27 Sep 2016 05:48:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CRq0Fc_r1IUP for ; Tue, 27 Sep 2016 05:48:12 -0700 (PDT) Received: from mail-oi0-x264.google.com (mail-oi0-x264.google.com [IPv6:2607:f8b0:4003:c06::264]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EC2C12B0D7 for ; Tue, 27 Sep 2016 05:48:12 -0700 (PDT) Received: by mail-oi0-x264.google.com with SMTP id a62so651993oib.2 for ; Tue, 27 Sep 2016 05:48:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verisign-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:thread-topic:thread-index:date:message-id :references:in-reply-to:accept-language:content-language:user-agent :content-id:content-transfer-encoding:mime-version; bh=+iPsRtoumzP9gYeEoSGBo8eYQH0K7Wr8jee92nUiLuo=; b=kYnLxDEP6sBH+1T6ZGD+pE8202LYMTNwasFmlviAPe1hHlG94dZ7qDb5vAOvhh1Hbe aEHjQ3g+UxF0UZprXVYNKA1Ipi9lnq2Vka3sljY9kz3jg1t8BYZD86obCnTR4klgOunQ XWP9wrNpXIHR68pca1+WQvI+qeARh1ais2Jw6crBQV1lA8TuM64G7Dym+ROtUwwAymqp sJNVOqoo9BTRQRKKj0i3GrniTRxXFNTKcH2gIIQQWlh41AwFs7uv0g+4dODCwU8r+B20 vmyU/KvTuEN32uSgGkCH0o8sviD15Xp6sMfgV//ZQtD0HSGilpzxxFdhDl8qxlZwVfVZ LOow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:thread-topic:thread-index:date :message-id:references:in-reply-to:accept-language:content-language :user-agent:content-id:content-transfer-encoding:mime-version; bh=+iPsRtoumzP9gYeEoSGBo8eYQH0K7Wr8jee92nUiLuo=; b=Ry1Fg1GHV1qlsFfeUdI5RPBR3vA7FBTLGZCz4js3Lhyqihi6nVqiuX8AzACLMWFY67 lpwNfQ3qi1Ss2cueQ/RuI9JpmyjjA2TgNpE/WU0NiUzXi06dTIsoXCOhE71fH1O9Rzfj eDDq3+UZReqE4VFsRnDZ3CeK36g2YZyjuNyryCP2FnK/0Um9WQf3WQMWZGL4UZLgTlQf fof+SDASCPUpYusFJ7pyI0DXwjHqo1nAAEn3ddlYQeoTBaA1CB9mmQxm/lDxDU6UUQDS cqN5QukDvmDRxFqMu3jezhBiV6Q2+6cVk+GxGXdOZ+hvSlWUnAvFIwmxTIB7HyIkU9Tt JpwQ== X-Gm-Message-State: AE9vXwPusAM5xPLkLax3UOLR/L1HgdXlYFnt9KZx4ITWC5VYjxGgiurix2gZFrKQp2VPTDcx9bvF1Rb4jd8SStSOMtkm54E/ X-Received: by 10.107.20.87 with SMTP id 84mr27670649iou.214.1474980491772; Tue, 27 Sep 2016 05:48:11 -0700 (PDT) Received: from brn1lxmailout01.verisign.com (brn1lxmailout01.verisign.com. [72.13.63.41]) by smtp-relay.gmail.com with ESMTPS id z65sm551074itb.4.2016.09.27.05.48.11 (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 27 Sep 2016 05:48:11 -0700 (PDT) X-Relaying-Domain: verisign.com Received: from BRN1WNEXCHM01.vcorp.ad.vrsn.com (brn1wnexchm01 [10.173.152.255]) by brn1lxmailout01.verisign.com (8.13.8/8.13.8) with ESMTP id u8RCmA6E010735 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 27 Sep 2016 08:48:11 -0400 Received: from BRN1WNEXMBX01.vcorp.ad.vrsn.com ([::1]) by BRN1WNEXCHM01.vcorp.ad.vrsn.com ([::1]) with mapi id 14.03.0301.000; Tue, 27 Sep 2016 08:48:08 -0400 From: "Teague, Nik" To: Flemming Andreasen , "Tirumaleswar Reddy (tireddy)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0toPF595o2AeUWLwWc6/c3wEKCLwdeAgACWpICAAKoHAIAAh3mAgAAWCAA= Date: Tue, 27 Sep 2016 12:48:07 +0000 Message-ID: References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1a.1.160916 x-originating-ip: [10.173.152.4] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 12:48:21 -0000 T24gMjcvMDkvMjAxNiwgMTM6MjksICJEb3RzIG9uIGJlaGFsZiBvZiBGbGVtbWluZyBBbmRyZWFz ZW4iIDxkb3RzLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGZhbmRyZWFzQGNpc2NvLmNv bT4gd3JvdGU6DQoNCiAgICBBcyBmb3IgaGF2aW5nIHRoZSBzYW1lIGRhdGEgY29udmV5ZWQgdmlh IG11bHRpcGxlIGF2ZW51ZXMsIGl0IGFkZHMgDQogICAgYWRkaXRpb25hbCBjb21wbGV4aXR5IGFu ZCBsZWFkcyB0byB2YXJpb3VzIGluY29uc2lzdGVuY3kgYW5kIHJhY2UgDQogICAgY29uZGl0aW9u IGlzc3VlcyB5b3UgaGF2ZSB0byBkZWFsIHdpdGguIEknbSBub3QgaW4gZmF2b3Igb2YgdGhhdCB1 bmxlc3MgDQogICAgaXQgYWRkcyBzdWJzdGFudGlhbCBiZW5lZml0cywgYW5kIEkgaGF2ZW4ndCBz ZWVuIHRob3NlIHlldC4NCg0KSSBhZ3JlZSB0aGF0IHRoaXMgbmVlZHMgdG8gYmUgc2V0IHZpYSBh IHNpbmdsZSBtZXRob2QgYW5kIG5vdCBiZSByZXBlYXRlZCwgcmVkdW5kYW50IG9yIGhpZXJhcmNo aWNhbCBpbiBhbnkgd2F5LiAgU3ByZWFkaW5nIGl0IGFjcm9zcyBkaWZmZXJlbnQgY2hhbm5lbHMg anVzdCBjcmVhdGVzIHByb2JsZW1zIGFuZCB3aGF0IGlm4oCZcy4NCg0KVGhhbmtzLA0KDQotTmlr DQoNCg== From nobody Tue Sep 27 05:50:42 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1384412B143 for ; Tue, 27 Sep 2016 05:50:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RbHtrRjF6GwP for ; Tue, 27 Sep 2016 05:50:38 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F07312B04F for ; Tue, 27 Sep 2016 05:50:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4335; q=dns/txt; s=iport; t=1474980638; x=1476190238; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=Cq4GVYERre+bfRB/IXLAc2xbS6z6xfRsOYLFn/ZjNo4=; b=YXjyxPh8cnlTly3cHe4OwVV4YwfsY33ASDnXWbArjW+7Kf7CrVDhaOv8 4+Qv8x33j10huuqKO7gUAGkKoa7hoo/yaZczbCcwKyv0Idx4B88auyUlj /Teal3j0M4O7su3znqfCreMDS3rZxYX0LO6GDs730GZbu24TWqRMDWTlV 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AdAQA3aupX/5pdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgz8BAQEBAR6BUweNLKlBgg+CBoYeAoFnOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwE6SwQCAQgRBAEBAR4JBzIUCQgCBAESCIg9CL8SAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBHIY3hFSBPIJyhXQFmXYBj2KPc4xrg3wBHjaFBnKFWH8BAQE?= X-IronPort-AV: E=Sophos;i="5.30,405,1470700800"; d="scan'208";a="151339340" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Sep 2016 12:50:37 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id u8RCob4U021635 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 27 Sep 2016 12:50:37 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 27 Sep 2016 07:50:36 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Tue, 27 Sep 2016 07:50:36 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Flemming Andreasen (fandreas)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLeGWwgADw2YCAAFQTwIAA3W6A//+theA= Date: Tue, 27 Sep 2016 12:50:36 +0000 Message-ID: <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.65.67.234] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 12:50:41 -0000 > -----Original Message----- > From: Flemming Andreasen (fandreas) > Sent: Tuesday, September 27, 2016 5:59 PM > To: Tirumaleswar Reddy (tireddy) ; dots > Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >=20 >=20 >=20 > On 9/27/16 12:24 AM, Tirumaleswar Reddy (tireddy) wrote: > >> -----Original Message----- > >> From: Flemming Andreasen (fandreas) > >> Sent: Monday, September 26, 2016 11:46 PM > >> To: Tirumaleswar Reddy (tireddy) ; dots > >> > >> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration > >> > >> > >> > >> On 9/26/16 5:16 AM, Tirumaleswar Reddy (tireddy) wrote: > >>>> -----Original Message----- > >>>> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming > >>>> Andreasen > >>>> (fandreas) > >>>> Sent: Sunday, September 25, 2016 10:10 PM > >>>> To: dots > >>>> Subject: [Dots] DOTS Requirements: DATA-003 Session configuration > >>>> > >>>> Requirement DATA-003 (Session configuration), which deals with the > >>>> data channel requirement, include the following: > >>>> > >>>> DOTS server > >>>> implementations MUST have mechanisms to configure the > following: > >>>> > >>>> * Acceptable signal lossiness, as described in GEN-002. > >>>> > >>>> * Heartbeat intervals, as described in OP-002. > >>>> > >>>> * Maximum mitigation lifetime, as described in OP-005. > >>>> > >>>> * Resource identifiers, as described in OP-006. > >>>> > >>>> > >>>> Resource identifier config makes sense to me, but why aren't the > >>>> first 3 simply part of the signal channel establishment procedure > >>>> (which would have the added benefit of allowing them to be adjusted > >>>> more easily later > >>>> on) ? > >>> Acceptable signal lossiness configuration helps determine the > >>> lossiness > >> parameters (e.g. max number of re-transmissions, max re-transmission > >> parameters etc.) for the first DOTS signal message. The first DOTS > >> signal message may convey new signal lossiness configuration > >> parameters for subsequent DOTS signal messages. > >>> Heartbeat intervals and Maximum mitigation lifetime configuration in > >>> DOTS > >> data channel can be treated as global configuration used for all DOTS > >> signal channels b/w DOTS agents, unless specifically over-written by > >> the DOTS signal channel. > >> Seems like more complexity than needed - I'd just have one set of > >> values in the protocol (signal channel). > > The advantage of the above approach is: setting the values in data chan= nel > during peace time avoids the need to convey the configuration parameters = in > the signal channel during DDoS attack. > You have to establish a bidirectional mutually authenticated signal chann= el > regardless, so at least one message needs to get through - that message c= an > simply set the value. That one message can convey the DOTS signal, and over-loading this request = with additional configuration parameters will increase the complexity of ha= ndling error conditions where the server may act on the DOTS signal but the= configuration parameters may not be acceptable to the server. The negotia= tion of the configuration may take multiple requests/responses and may invo= lve multiple re-transmissions during a DDOS attack. >=20 > As for having the same data conveyed via multiple avenues, it adds additi= onal > complexity and leads to various inconsistency and race condition issues y= ou > have to deal with. I'm not in favor of that unless it adds substantial be= nefits, > and I haven't seen those yet. The advantage is DOTS data channel will anyway be created during the peacet= ime to create alias, it can also be used to negotiate configuration paramet= ers and can be used for all the DOTS signal channels. The message transmission parameters negotiated in DOTS data channel during = peace time can be used influence the max number of retransmissions, max ret= ransmission span etc. for first DOTS signal message. I don't see a need to re-negotiate the configuration parameters in the DOTS= signal channel during a DDOS attack. >=20 > Thanks >=20 > -- Flemming From nobody Tue Sep 27 06:14:56 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3D2D12B162 for ; Tue, 27 Sep 2016 06:14:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aPb9xH7qsIiz for ; Tue, 27 Sep 2016 06:14:52 -0700 (PDT) Received: from mail-ua0-x22c.google.com (mail-ua0-x22c.google.com [IPv6:2607:f8b0:400c:c08::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE0A312B151 for ; Tue, 27 Sep 2016 06:14:51 -0700 (PDT) Received: by mail-ua0-x22c.google.com with SMTP id n13so10191133uaa.3 for ; Tue, 27 Sep 2016 06:14:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=hsdzNdKMf7AzRLMY8AO/iwFuRok0ZAxeOId3Axdh3o0=; b=SeJaYfs88ipYbjeXN8cd0+dU0+NNGVBE/qgKzBWsaDrdRek8BEEzNtGNfCtpqH4Tej MyMUCIjd8brgJhz/NqJBccYDjVoOm2l9VbcLbC6Ta/YoFRp3NK9jBE5OBa/lAet3n8qg RGKBwcFc1AaO+qRyqg4ftMsSRPA9vcTBPTG3Yx744b00yMNaveip4Z413RfEnU7xJYsR MC8DXBDorwjyHsztjLS1UIdDtDQEXsPF6q5f2UQ15/va3HRmogs0D68EG+/Dw9YLjJeF bO70qoPDpqvWMBHwR0t2SddLRfV+GhVbaGlaFCQS5XagXtKIgrvB2uVlz+M3MAzFSqlT QLhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=hsdzNdKMf7AzRLMY8AO/iwFuRok0ZAxeOId3Axdh3o0=; b=DHxg5UIXgd/J22r6JO1DtpCN7ET0uX1k5RbH9y9JhrDpFIqQp+F1Lp0iGcIKdO8s4m ucvd/Zcon9xJMaR8Jb/S1f7nI8igxvgrHHQwydSEZRwOMP7f/DWgXlMC2u9Ch91Tu+Rk ky/jtGWaQMr1d7hyTabSRZoZ/r3KDWYrVl+mRwkRr65Lp9wqrwXlj4xgQEpsdXbWWRxz X03tWrAmtsBycalJTon1iKHhFgw1rO/ijG6Z0zziKvex/S+ZwDiocn3vNMm0dPWO3v85 VXbUgy6ZcofhHicblIQUnIb/RYcaLUvHAnIhJsiOFXlFhzs+sOnKyRKg+hHu13M++08Z gCew== X-Gm-Message-State: AA6/9RkgN00viHtIBm/MFmbCNnor/WUMuhcnnnZu42IwFdyvCEM1wWFL05L3ZM8+dsu/PtZWyyMJrsinfFTVIg== X-Received: by 10.159.32.198 with SMTP id 64mr2581681uaa.165.1474982090747; Tue, 27 Sep 2016 06:14:50 -0700 (PDT) MIME-Version: 1.0 Received: by 10.176.65.8 with HTTP; Tue, 27 Sep 2016 06:14:50 -0700 (PDT) From: Kathleen Moriarty Date: Tue, 27 Sep 2016 09:14:50 -0400 Message-ID: To: "dots@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [Dots] DDoS with GRE X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 13:14:56 -0000 Hi, Is anyone familiar with the Krebs on Security DDoS: https://noise.getoto.net/tag/gre-ddos/ Are there things we should be doing with GRE to help prevent this type of DDoS? We are reviewing a draft on GRE-in-UDP this week, so it would be good to know if we should be specifying more. https://datatracker.ietf.org/doc/draft-ietf-tsvwg-gre-in-udp-encap/ Thanks! -- Best regards, Kathleen From nobody Tue Sep 27 06:50:11 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D7B412B1C1 for ; Tue, 27 Sep 2016 06:50:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=arbor.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TMDYP1DLlXsb for ; Tue, 27 Sep 2016 06:50:06 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0115.outbound.protection.outlook.com [104.47.42.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAB2712B1A0 for ; Tue, 27 Sep 2016 06:50:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arbor.net; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Jl6jQ56cJ1sQ8flpKNaBs5oYi/sLMW8/cYh/RhaGT7o=; b=TuFiOJd8E0dDIPFX7Y/BINrqWo97YhXPKtWYZWth4ckSoJ03SoB7F5ySbSxN6zhYcJtfgAGDVlZhYz9YOTZr/PbYzjLgMK3m6kn4P0gHYbRO6NGjjcRSszKSTeELC9melMDCMF7LPptj19k9Dc8boG/Y7bZF73/QLLQ8NpLXQ3A= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=rdobbins@arbor.net; Received: from [172.19.254.107] (49.228.99.187) by BN3PR0101MB1026.prod.exchangelabs.com (10.160.182.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.639.5; Tue, 27 Sep 2016 13:50:02 +0000 From: Roland Dobbins To: "dots@ietf.org" Date: Tue, 27 Sep 2016 20:49:43 +0700 Message-ID: <93A3E814-3A61-4F52-BB75-AA9F2DA57AF8@arbor.net> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; format=flowed Content-Transfer-Encoding: quoted-printable X-Mailer: MailMate (1.9.5r5263) X-Originating-IP: [49.228.99.187] X-ClientProxiedBy: SG2PR03CA0036.apcprd03.prod.outlook.com (10.160.233.46) To BN3PR0101MB1026.prod.exchangelabs.com (10.160.182.155) X-MS-Office365-Filtering-Correlation-Id: b8d4d107-b731-4faa-4d90-08d3e6dd2e77 X-Microsoft-Exchange-Diagnostics: 1; BN3PR0101MB1026; 2:jwAeIZIcyzt7XiKCKM8ZoysKm8m//3n3lhNpazRue/bgfT0SzLQsWHjXOPtaAfJAA07oUXWNNevCCKEYTefapJhxItT0yw8HegOgPzMj9bzZcdNIMPRD54PRwPdZqHoar+lj74V+4Fa7GQakCqiM4nVrxgxZKph89kJcvRdZnRA4nJgvyBODVpGt8Z5SAv8b; 3:D2BojTSBIIuTAJodDj7m81aPjBsvClr3Nj78dD+bswKs9All1yynovqCfPw4200j27U0666F7PVAAaWldhZVsDlQ1jwt/F65zcJg6tCrstcHK1uU50psxfNr3lOYo/nF X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0101MB1026; X-Microsoft-Exchange-Diagnostics: 1; BN3PR0101MB1026; 25:AvxVwseyjNG4SzqDRf/5e7sHEYnw5S0VR306p6KKICtFLROmySP5paGQeSiE5C26cDhZWVNmRD9cu0T+Z+mAnU/1iYGghm5tT6VgJGfLFTsPi+uQ1D636oylpvYiiYhcNQUyD4RUzEXeT9bBY76/D5eQvSH+RRdprqcP17nIdqMQijyWLuYP/t0cj3grOrvUt1EUOLOf9WR5v5WZGN5i8DUDKnWEhRBlyEJHawCSUS8taoEJ40+m6eXjD6Hb2I3w2nGWMfuZKAt6q+jj17X3Yt0s3Q3RKboyn7UEPFqAvYpKHsEBMMI4y6IwL6ynaycWeJ7mBmKswg2RJWqx9Ts6SR+ZW9w/ms55qq5BxVbLa/1vjq0yji63+1Uwi44J8aFkRGp/9qxF+tqdueZ1u7DPftNSh734xC2VA3le1x3VLMnL9paP8GcRBBYBdVT9gpBxzUyD+e8Uy2EEmoHh8//G+rHhwv8MSr+2Ze8RYpUXi/nhZpi6so1qgkr93NC7PvNqKJBK8XRFYl3ACI+NqthfZorjs6LyAW0/zRMOWPPWftBeq8I4FREw6E2H4Yuua/IbWhG5pCkbxsGEi5m+SCreXCD8Aqu7xvN5RsiDgKzDZm32VMAj2y+dnNuz31gIM/XZLEi9xgfNFJpPpbHb9ChXie16WbsOjrzgvJOUGekTQ723i0poOUUfwsDhYJR/fYagCpzg5ZuzQAB2tRNNpYfXCmiFkKINKLH4EJIP7STwiTqNtWQZJxpArUI3s1jY6Z80XPihLuUD0GNfh2u9+1FMKrG79bXysHhwGaWpmaJZDlgsps6MQHs7gndmFIxeCP8tbySvC5wJN87EnwDPaVGm2A== X-Microsoft-Exchange-Diagnostics: 1; BN3PR0101MB1026; 31:YN3u3kabOEHde1DHP4ijJXoJ7utZvYtnqiKtHTcdcIvEz0sfkHrAuU4QtaMpvLGDJF21okTBAqAdqF2Nr1kOMjY7rsSDmVRK40z1TaB3n/88DsLgyxXAfdPJ9Xd9NcGBZRHecgecYfiYOpXG+TQDYIOi3KUl1f6miPwZH7CjCGB21w6bBBC6WkxcDm2AJiDRjCDrgXTpKWqOXyiW6ASL4jgFA4ROrkfYfwhXa/624sk=; 20:2TF8KCkSPzwEWTk4+AJ8Pwkkqx7UTiqdwuYWZ5zcm9/O5MOVxTEM9SPCR8AHdRgLBW4vUA3rLooQOvUFWvvu9xo/X8IjX1YrnzqZaz5tgAaM0Sm5XUPUOkwOPY4f3yoqIVIM1Khmnimb7O2XzshURJuq1fY9YTgnfHD/hfbww2aG+/btiELsmfZhc4D1dY97iHBCdQ6zM0pmvaWB0cQnj0viElOjGDk7SpC5AmVRzm4d5gfZ6wr0cVr9jEpEM2oGVWohZ13ruX6htw8YU1rCAocvsDNeHn1FxkHuE4Tm9i4lmDZpVWgvBtQdJMMuxCu9TZLV8begS49o9+SRiauErDilGoL1XgPkf1ae3ESa/Akx8V1UqSMwqFjd91eWYfJvDKoTX2oYa0PQpNA1dKc1WOBRhZvRhVZr41wEN0wZcyvwqWNMlnixweHwroPx/b0V9vI1yCYQirS5s3v8iWzZ7TSbaUEvgZr/sRW7jxl+82haATGP1clBEX0Vrw3XBIPV X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6043046)(6042046); SRVR:BN3PR0101MB1026; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0101MB1026; X-Microsoft-Exchange-Diagnostics: 1; BN3PR0101MB1026; 4:uUfdrzOHkm4FjE/vWHUyX+UMwPiH7/4Gp7BvZqoUsHa+unCOzvjtV6OBDEtUlf7q8X3bNswHmHq3XUoXGmz1xb0GIjxc53VH4/BpDiBW0tguEBI+ZmZZrDATFWlB2GJLH+sb/bsOf/XDBwYW8bP0b47bq/AVRWfr2bePArlXunJ8Te0/o5JaX55EuYkhnPhTQaxp7PDYf9+zUAxslKNLxZ0eQDJuTgkAQUXv4E1pPRRVfwIQPLJi3DsFNp1DdGs3tqUt7uBe+BB8oUIH+JY6OFr80Sy/vCBCDgYuAmbpyYozwpdsIaX06Kz9NcU1rdBkjr5UIYPiaJO57dCBBtIY0Clqd8LOvYrI826L5uAERCoEJzkbXAuU2Vdn+o26vy/m6O1SWUWayu+D/8B3k6H1fKU7sesPc5RclanRGasfwtgpHCzWrArJ6mnXXyN0d29kbMpqHVUsNzIjW3/fqHrogA== X-Forefront-PRVS: 007814487B X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(4630300001)(6049001)(6009001)(7916002)(199003)(24454002)(189002)(5640700001)(586003)(305945005)(42186005)(50466002)(7736002)(83716003)(106356001)(7846002)(105586002)(36756003)(68736007)(86362001)(66066001)(3846002)(2950100002)(6916009)(82746002)(33656002)(92566002)(6116002)(19580405001)(2351001)(450100001)(50226002)(77096005)(2906002)(19580395003)(47776003)(5003940100001)(15975445007)(101416001)(8746002)(2501003)(76176999)(81156014)(8676002)(107886002)(189998001)(110136003)(1730700003)(81166006)(5660300001)(50986999)(97736004)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0101MB1026; H:[172.19.254.107]; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: arbor.net does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BN3PR0101MB1026; 23:pLZmJHdiVIJJLnUEpT+VTzcASk2HqHCyJJquYHC?= =?us-ascii?Q?a2VnrnBKpyZPpdnbGjkNBSSYKunUoBJmAPtT+467YjBtNefQCJyANzxoAdNY?= =?us-ascii?Q?lVoEq8GdLENQ9USM1Uz4dcqrSlTpmgfNyAGDVn281Zg4m5zk86sttXcOiOsE?= =?us-ascii?Q?8jWe9LJWk6Eo+QT8DszHiiVRWo2uvhiR3YD6EZcdpneJTbc9xyUpv4Y6QFZF?= =?us-ascii?Q?zKFgKmgWLhfJYT+LhTYnHYWcqy6k72kS+0hn1NxRBGAHF1zDBtL/lp5UTaVN?= =?us-ascii?Q?4n8RF16YUjIvpGrL+Qgyf5HVBanrs9cOfk+ZrRyShxvT0w1SLHT3MlDDe46N?= =?us-ascii?Q?XgGmc3gpEn+/Y1I1sgb10+sSl5+gFqmploljhzy9tNT4jjkhm8AWhIIVgNys?= =?us-ascii?Q?dGPKuQq5XYlNRI5zscdwqhnlhlsYOKVU1xAmU36I4P+8UQnhyHCt4L3L3t6F?= =?us-ascii?Q?kE2AZ5KwOubxCukCkWg9O8zPwE5lgEWg1q3jrUdVf0yXYnJCwRugqLJRYF0Q?= =?us-ascii?Q?kcfLmjvgL1r6ija1Ue2JQIJpJ1YjmhxLIVJEnhIsUQuZXOd3xl8zC/TWF1H3?= =?us-ascii?Q?QsNR+mi9mBFrNUvTRcFMg/JzHQhRkZOJZQaNKyCkdhmMxNaQl4QDnxHGzadD?= =?us-ascii?Q?r4eZLd/OrTfUjbbudtG6S2g73gs+T+T/XzGQhbgtb9NtNBFghvbRcv60NuT5?= =?us-ascii?Q?6s68WMENYc/B2tccF+Tqldev7OmHSL2djHIsUTz2ASDVZY6+I4xsR5HrScZQ?= =?us-ascii?Q?6pMZtEYcrVE4/XMfAf+A73aOKG4k2NGDiYa4/HozfDJjFSkfCcYc7ryY86sC?= =?us-ascii?Q?q0eW74CvNLnGaA/rItO2PttO8VfL27Bffe56u6IkLB/xiYvlx+ONG2vRZyD4?= =?us-ascii?Q?+XRML/uLUJiCWgRIeGtYqLhGxO0Tzk1e/1NkgIxylSsHx4f7kSVFDJAZsC2D?= =?us-ascii?Q?RB294piNUsdc0l6cOG/OQx3ZYasIx8XGFFMd4sQ6B73wv940xfAqvEKCWci5?= =?us-ascii?Q?2pTBeBxMiAS62Tgg1bh+ewN31gkMTSX+eRbuWRVYxTY3gBx+i6GcuNbUQHuG?= =?us-ascii?Q?7H79MLcfg0KZPpH2VZQ4dx3PGVAxHtCEE6gBYtjzf2Dx3BYY+u7CD/H/Vxqp?= =?us-ascii?Q?cVa6XgNgLLTx+GXkPKm4GUC3sVvu8Kp/LxedhqRqZp+sql+1XiFTg9Rxnx8S?= =?us-ascii?Q?CKzvthjJKyiV5uWFJ//16zmJKpxaXo9d7fZk3bOKx9qI+fTL4l6aDXKv6XLR?= =?us-ascii?Q?ckFGRudg+tx3Rfzo3p7nftnjeSi2AJzpWsDkXpPaS7ZZ9hwiPFr1dMy/Sg3Z?= =?us-ascii?Q?0RwabxL/lseTU9G3yoEsq4bE=3D?= X-Microsoft-Exchange-Diagnostics: 1; BN3PR0101MB1026; 6:grZG0zj9G+2qBEIESbcyj6D1xyvTDVQ/o+vgjAlnkpjbb8VhITaAw0t0zY4dE5AHJkW2z7yn6SJqg4uKK1Zik0lkQ81sFrEZmyd0a8iM1VQYg8D2L50oTM2sRDz+eZHmHrCAUAIqS8rmCyZZlCvt/gr591vG5tve3ynRp5nUG3EY1NDU4LhcHztTSzHdg6PM38k1KAhtkl3Evt1zOYRCa5MZimSr7CjeSg9LIUoKPAjIwbGqnQEQCWKpIZ0PJVpPgDLH08JreVspq0yKuS5tMik+pbMeLiwceL8CIy2GG4kt5V+40PVO6Bd4XsUvCtO7; 5:NSmi+EZJycaP7aOrJgQOt6T1f5Q1webnZvwmXnUF9l1K3Z86qQt28KpBnUCfrs1gvQxwS1BgxmsoUZScT1ZF1nTR5ciU0gUahVsbbpA+0H0gBoDd9g3CwhvCr56YvQ/S2gdlujtOSm6tfOakL8j25w==; 24:kbk0OdGCa3zyRhNvOhDroQK2QwLT3qq0FoZ2syK2HljbHAWJZj1Aqd2fywQMVGdyqU00VvQx4Wfi2ojhiCmu8w3FZ3NBbC1WA8kjHNyTgo8=; 7:wx19DyuD2ho++SoLyy3YyEls2CZZrfu0jzqAntLpIJV7h0EY3ZPL4W7V0Y3WdgYcP2u/OTD7rSv5utYYu776QMzHOpLajX+yEHgwA52OZLoSP7W7s/RIxyn7iZZ9AHhnGSMhudYIqfuOoK1wurU47PoeJe8wYex7NIMsjoAasNXnNPxMupsF0cTEXZSMZsdzSjxNmCWUgh9JMuXyngLT/6FnHI50+Z9TfRld9yszjqDD6XvnNsbv/PXHD/zZBFw043KkM39BByQmd27f+yfisEgv/pcCPi+5S+POhYT4uOp7Gf/ZofB/LR/1qp5D0jWb SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: arbor.net X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Sep 2016 13:50:02.1545 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0101MB1026 Archived-At: Subject: Re: [Dots] DDoS with GRE X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 13:50:10 -0000 On 27 Sep 2016, at 20:14, Kathleen Moriarty wrote: > Is anyone familiar with the Krebs on Security DDoS: > https://noise.getoto.net/tag/gre-ddos/ Same thing written about here, ~16-year-old technique: > Are there things we should be doing with GRE to help prevent this type = > of DDoS? There's actually nothing GRE-specific about it - any IP protocol can be = abused this way (we've seen ESP and IPv4 Protocol 0 abused the same = way). There's nothing needed to modify in terms of the protocol = behavior, et. al. Thanks much for investigating, though - it's greatly appreciated! ----------------------------------- Roland Dobbins From nobody Tue Sep 27 06:55:55 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CECA712B1D4 for ; Tue, 27 Sep 2016 06:55:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yHnglBCim2en for ; Tue, 27 Sep 2016 06:55:52 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D01E312B1D2 for ; Tue, 27 Sep 2016 06:55:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5450; q=dns/txt; s=iport; t=1474984551; x=1476194151; h=subject:to:references:from:message-id:date:mime-version: in-reply-to:content-transfer-encoding; bh=XqU4Kqeh3ZOxbfb0+UHbdSCcFxpTcC6+8WXUaGuZz28=; b=FDfq9cHBake6U3utvbIQPtafvGOFEpP/0GuCrqxgOqVuGHr32t2MnacD wLFkakPNqKHKVNDrOnWWAb6YR28Ydd1whz5Un9knrLsM0RKPaz9JT0vCM gnIZgNuikqdziN/ubVtzSGO/3/gDsejE7IM9cKARg+6dbkH2Tnmpx0+6h E=; X-IronPort-AV: E=Sophos;i="5.30,405,1470700800"; d="scan'208";a="326826858" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Sep 2016 13:55:51 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id u8RDtoLO016912; Tue, 27 Sep 2016 13:55:51 GMT To: "Tirumaleswar Reddy (tireddy)" , dots References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> From: Flemming Andreasen Message-ID: <7606d458-6818-9246-b522-d90989ef110d@cisco.com> Date: Tue, 27 Sep 2016 09:55:50 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 13:55:54 -0000 I think we have different views of the DOTS world here. My view is that you start establishing a signal channel, and you may establish a data channel that occasionally can be used to convey various operationally related parameters, such as whitelists, blacklists, filters, etc. The signal channel should specify how the signal channel works as part of the signal channel establishment; that includes configuration parameters, extensions supported, etc. No DOTS signal channel => no DOTS operation. No DOTS data channel does not necessarily imply the same. As to arguments around the data channel being the better place to negotiate things because it's used during peace-time, it's a red herring because the signal channel will obviously work just as well in peace-time. Now, I agree, we should'n't renegotiate the parameters in question during an attack, but again, it's orthogonal to whether that is done in the signal or data channel - if anything, the data channel would have a much lower chance of working during an active DDoS attack. Thanks -- Flemming On 9/27/16 8:50 AM, Tirumaleswar Reddy (tireddy) wrote: >> -----Original Message----- >> From: Flemming Andreasen (fandreas) >> Sent: Tuesday, September 27, 2016 5:59 PM >> To: Tirumaleswar Reddy (tireddy) ; dots >> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >> >> >> >> On 9/27/16 12:24 AM, Tirumaleswar Reddy (tireddy) wrote: >>>> -----Original Message----- >>>> From: Flemming Andreasen (fandreas) >>>> Sent: Monday, September 26, 2016 11:46 PM >>>> To: Tirumaleswar Reddy (tireddy) ; dots >>>> >>>> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >>>> >>>> >>>> >>>> On 9/26/16 5:16 AM, Tirumaleswar Reddy (tireddy) wrote: >>>>>> -----Original Message----- >>>>>> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming >>>>>> Andreasen >>>>>> (fandreas) >>>>>> Sent: Sunday, September 25, 2016 10:10 PM >>>>>> To: dots >>>>>> Subject: [Dots] DOTS Requirements: DATA-003 Session configuration >>>>>> >>>>>> Requirement DATA-003 (Session configuration), which deals with the >>>>>> data channel requirement, include the following: >>>>>> >>>>>> DOTS server >>>>>> implementations MUST have mechanisms to configure the >> following: >>>>>> * Acceptable signal lossiness, as described in GEN-002. >>>>>> >>>>>> * Heartbeat intervals, as described in OP-002. >>>>>> >>>>>> * Maximum mitigation lifetime, as described in OP-005. >>>>>> >>>>>> * Resource identifiers, as described in OP-006. >>>>>> >>>>>> >>>>>> Resource identifier config makes sense to me, but why aren't the >>>>>> first 3 simply part of the signal channel establishment procedure >>>>>> (which would have the added benefit of allowing them to be adjusted >>>>>> more easily later >>>>>> on) ? >>>>> Acceptable signal lossiness configuration helps determine the >>>>> lossiness >>>> parameters (e.g. max number of re-transmissions, max re-transmission >>>> parameters etc.) for the first DOTS signal message. The first DOTS >>>> signal message may convey new signal lossiness configuration >>>> parameters for subsequent DOTS signal messages. >>>>> Heartbeat intervals and Maximum mitigation lifetime configuration in >>>>> DOTS >>>> data channel can be treated as global configuration used for all DOTS >>>> signal channels b/w DOTS agents, unless specifically over-written by >>>> the DOTS signal channel. >>>> Seems like more complexity than needed - I'd just have one set of >>>> values in the protocol (signal channel). >>> The advantage of the above approach is: setting the values in data channel >> during peace time avoids the need to convey the configuration parameters in >> the signal channel during DDoS attack. >> You have to establish a bidirectional mutually authenticated signal channel >> regardless, so at least one message needs to get through - that message can >> simply set the value. > That one message can convey the DOTS signal, and over-loading this request with additional configuration parameters will increase the complexity of handling error conditions where the server may act on the DOTS signal but the configuration parameters may not be acceptable to the server. The negotiation of the configuration may take multiple requests/responses and may involve multiple re-transmissions during a DDOS attack. > >> As for having the same data conveyed via multiple avenues, it adds additional >> complexity and leads to various inconsistency and race condition issues you >> have to deal with. I'm not in favor of that unless it adds substantial benefits, >> and I haven't seen those yet. > The advantage is DOTS data channel will anyway be created during the peacetime to create alias, it can also be used to negotiate configuration parameters and can be used for all the DOTS signal channels. > > The message transmission parameters negotiated in DOTS data channel during peace time can be used influence the max number of retransmissions, max retransmission span etc. for first DOTS signal message. > > I don't see a need to re-negotiate the configuration parameters in the DOTS signal channel during a DDOS attack. > >> Thanks >> >> -- Flemming > . > From nobody Tue Sep 27 06:58:59 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F0A512B1C3 for ; Tue, 27 Sep 2016 06:58:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W7L-TpHP_afD for ; Tue, 27 Sep 2016 06:58:55 -0700 (PDT) Received: from mail-ua0-x22c.google.com (mail-ua0-x22c.google.com [IPv6:2607:f8b0:400c:c08::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EE0412B1BD for ; Tue, 27 Sep 2016 06:58:55 -0700 (PDT) Received: by mail-ua0-x22c.google.com with SMTP id u68so11373116uau.1 for ; Tue, 27 Sep 2016 06:58:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=tWtI3KX+gVhPtQ5qe7Nu0QVwRBwvH2rli9BwSnSI9Ek=; b=hBgMKH6kDFkeu91Joo/hOr84JS1Oz+58/TOvsMAeOCGa0yeLyaDuAZ1uaji1y5p8tb v6XkYnYErO83Z2tM7CVFoGllIJ6gssiNeZvlrT279ha+E65pefKNt3kjOiD6rFvXXvaW Fgp04SLm79NvlXhv7y6EPXgZ6kuNy/1MRZLhJ3f2myoYr6+cgWm08q9Ljso2Q3omCSTz IashzKfdGAqZPO/brDKL07lZ9LXzOxQvyOFkYKYY4cokF5OESd/sXmPJ+XUr2b5S3OyH qhF6xCesz1hlKGL+zgmfh+1PDH9qbpv1U0g9YtK3QGFVmYnZeMj668YR3sCub/ZJV3i0 2lEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=tWtI3KX+gVhPtQ5qe7Nu0QVwRBwvH2rli9BwSnSI9Ek=; b=UlaZhcaOK7f/SQ/KXc5WaMHk31AVvV6CHaRcyF9cc5T9YXYTmdLHmu1gFHC2VeRPJM w3pF4EudWJSuM52GQF/zjmZDNOpQZtIc9JKuoK4G8vv6DTKs3xtHyI0zcbPBLyGeugsd 0uNdR4WWlgC9epTNBrTGgFRy16V3FTIXyE/7FTOA4WKCHNQyAYjFmn4GnI13CNl3gP5k lfW6I7Q7gO3aDERgWK6G+S1WuN5k5TB0yUxOGFpNFp4a7ZLF2LqnIk1CYT9Et4xA8ooo pbezweujaW7bYCVu23vk1Xt6RmwUMJNkfmGks1bnmqRuBFV3wA6SzvNnLY7mI/LtCQX/ Kr1Q== X-Gm-Message-State: AA6/9Rn6f6mlr9azCOeihFkM4ka4PDR1QgTTXkBKSbw3hWmJ0yaYD5UdeGHY4NQFNaJ+RxT6XTAMOlu+IB202w== X-Received: by 10.176.85.77 with SMTP id u13mr2218801uaa.48.1474984734777; Tue, 27 Sep 2016 06:58:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.176.65.8 with HTTP; Tue, 27 Sep 2016 06:58:54 -0700 (PDT) In-Reply-To: <93A3E814-3A61-4F52-BB75-AA9F2DA57AF8@arbor.net> References: <93A3E814-3A61-4F52-BB75-AA9F2DA57AF8@arbor.net> From: Kathleen Moriarty Date: Tue, 27 Sep 2016 09:58:54 -0400 Message-ID: To: Roland Dobbins Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "dots@ietf.org" Subject: Re: [Dots] DDoS with GRE X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 13:58:58 -0000 Thanks, Roland! On Tue, Sep 27, 2016 at 9:49 AM, Roland Dobbins wrote: > On 27 Sep 2016, at 20:14, Kathleen Moriarty wrote: > >> Is anyone familiar with the Krebs on Security DDoS: >> https://noise.getoto.net/tag/gre-ddos/ > > > Same thing written about here, ~16-year-old technique: > > > >> Are there things we should be doing with GRE to help prevent this type of >> DDoS? > > > There's actually nothing GRE-specific about it - any IP protocol can be > abused this way (we've seen ESP and IPv4 Protocol 0 abused the same way). > There's nothing needed to modify in terms of the protocol behavior, et. al. > > Thanks much for investigating, though - it's greatly appreciated! > > ----------------------------------- > Roland Dobbins > > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots -- Best regards, Kathleen From nobody Tue Sep 27 07:08:18 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C4B812B1F1 for ; Tue, 27 Sep 2016 07:08:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.218 X-Spam-Level: X-Spam-Status: No, score=-4.218 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-2.316, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4EZpchJQ7XXH for ; Tue, 27 Sep 2016 07:08:15 -0700 (PDT) Received: from guri.nttv6.jp (guri.nttv6.jp [IPv6:2402:c800:ff06:a::4]) by ietfa.amsl.com (Postfix) with ESMTP id BF24F12B209 for ; Tue, 27 Sep 2016 07:07:43 -0700 (PDT) Received: from z.nttv6.jp (z.nttv6.jp [IPv6:2402:c800:ff06:6::f]) by guri.nttv6.jp (NTTv6MTA) with ESMTP id 1DB6B4E679 for ; Tue, 27 Sep 2016 23:07:43 +0900 (JST) Received: from SR2-nishizuka.local (fujiko.nttv6.jp [IPv6:2402:c800:ff06:136::141]) by z.nttv6.jp (NTTv6MTA) with ESMTP id 03CCA3AC83 for ; Tue, 27 Sep 2016 23:07:42 +0900 (JST) References: <147447226744.26532.10284561012526393211.idtracker@ietfa.amsl.com> To: dots@ietf.org From: kaname nishizuka Message-ID: Date: Tue, 27 Sep 2016 23:07:42 +0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <147447226744.26532.10284561012526393211.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Dots] DDoS Open Threat Signaling (dots) WG Virtual Meeting: 2016-09-27 X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 14:08:17 -0000 I'm experiencing audio trouble, I'll get back after rebooting my PC. kaname nishizuka On 2016/09/22 0:37, IESG Secretary wrote: > The DDoS Open Threat Signaling (dots) Working Group will hold > a virtual interim meeting on 2016-09-27 from 10:00 to 11:30 America/New_York. > > Agenda: > (No agenda submitted) > > Information about remote participation: > https://ietf.webex.com/ietf/j.php?MTID=m84a8c2f46520bfc038867c113c274cfa > > Meeting number: 646 441 945 Meeting password: kfTN2mvh Dial-in Numbers: 1-877-668-4493 Call-in toll free number (US/Canada) 1-650-479-3208 Call-in toll number (US/Canada) > > _______________________________________________ > Dots mailing list > Dots@ietf.org > https://www.ietf.org/mailman/listinfo/dots From nobody Tue Sep 27 07:16:07 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BC6C12B1E1 for ; Tue, 27 Sep 2016 07:16:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Ca_6NdOonum for ; Tue, 27 Sep 2016 07:16:02 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D257112B1F0 for ; Tue, 27 Sep 2016 07:16:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6420; q=dns/txt; s=iport; t=1474985761; x=1476195361; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=T0qIzTUYB+WpbH+wYrE1IfGzhY+N5y8rNNvOnQ20bJE=; b=G3ZT8u8e8Y4Ybb2MHt6w9P9xNvnNGWhEoNIMDb3Bh38gWA8VHBVkDFzL xEa+RJcQDCl0nAIKTI6gfh0MSL7uM3ee0Qmj177uLNmWbEkxRoIUClDOn Cav6lD418Bwiq+pvltLZGdM/glkE+bsnhssV+K+XpYgjKKMZY+J6Juw94 c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AdAQDCfepX/4kNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgz8BAQEBAR6BUweNLKlDgg+CBoYeAoFqOBQBAgEBAQEBAQFeJ4R?= =?us-ascii?q?hAQEBAwE6RAcEAgEIEQQBAQEeCQcyFAkIAgQBEgiIPQi+dQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBARyGN4RUgTyCcoV0BZl2AY9ij3OMa4N8AR42hQZyhVh/AQEB?= X-IronPort-AV: E=Sophos;i="5.30,405,1470700800"; d="scan'208";a="156439552" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Sep 2016 14:16:00 +0000 Received: from XCH-RCD-001.cisco.com (xch-rcd-001.cisco.com [173.37.102.11]) by alln-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id u8REG01R018736 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 27 Sep 2016 14:16:00 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-RCD-001.cisco.com (173.37.102.11) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 27 Sep 2016 09:16:00 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Tue, 27 Sep 2016 09:15:59 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Flemming Andreasen (fandreas)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLeGWwgADw2YCAAFQTwIAA3W6A//+theCAAGqsAP//rNow Date: Tue, 27 Sep 2016 14:15:59 +0000 Message-ID: References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> <7606d458-6818-9246-b522-d90989ef110d@cisco.com> In-Reply-To: <7606d458-6818-9246-b522-d90989ef110d@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.65.67.234] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Sep 2016 14:16:06 -0000 > -----Original Message----- > From: Flemming Andreasen (fandreas) > Sent: Tuesday, September 27, 2016 7:26 PM > To: Tirumaleswar Reddy (tireddy) ; dots > Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >=20 > I think we have different views of the DOTS world here. My view is that y= ou > start establishing a signal channel, and you may establish a data channel= that > occasionally can be used to convey various operationally related paramete= rs, > such as whitelists, blacklists, filters, etc.=20 In various scenarios, DOTS data channel is supposed to be established befor= e DOTS signal channel, for example to create alias for resources.=20 > The signal channel should specify how > the signal channel works as part of the signal channel establishment; tha= t > includes configuration parameters, extensions supported, etc. >=20 > No DOTS signal channel =3D> no DOTS operation. > No DOTS data channel does not necessarily imply the same. >=20 > As to arguments around the data channel being the better place to negotia= te > things because it's used during peace-time, it's a red herring because th= e > signal channel will obviously work just as well in peace-time. Now, I agr= ee, we > should'n't renegotiate the parameters in question during an attack, but a= gain, > it's orthogonal to whether that is done in the signal or data channel - i= f > anything, the data channel would have a much lower chance of working > during an active DDoS attack. Yes, DOTS data channel is expected to be used only during peacetime.=20 If we agree that configuration parameters should be negotiated during peace= time then using DOTS signal channel to negotiate them works for me. -Tiru >=20 > Thanks >=20 > -- Flemming >=20 >=20 > On 9/27/16 8:50 AM, Tirumaleswar Reddy (tireddy) wrote: > >> -----Original Message----- > >> From: Flemming Andreasen (fandreas) > >> Sent: Tuesday, September 27, 2016 5:59 PM > >> To: Tirumaleswar Reddy (tireddy) ; dots > >> > >> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration > >> > >> > >> > >> On 9/27/16 12:24 AM, Tirumaleswar Reddy (tireddy) wrote: > >>>> -----Original Message----- > >>>> From: Flemming Andreasen (fandreas) > >>>> Sent: Monday, September 26, 2016 11:46 PM > >>>> To: Tirumaleswar Reddy (tireddy) ; dots > >>>> > >>>> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session > >>>> configuration > >>>> > >>>> > >>>> > >>>> On 9/26/16 5:16 AM, Tirumaleswar Reddy (tireddy) wrote: > >>>>>> -----Original Message----- > >>>>>> From: Dots [mailto:dots-bounces@ietf.org] On Behalf Of Flemming > >>>>>> Andreasen > >>>>>> (fandreas) > >>>>>> Sent: Sunday, September 25, 2016 10:10 PM > >>>>>> To: dots > >>>>>> Subject: [Dots] DOTS Requirements: DATA-003 Session configuration > >>>>>> > >>>>>> Requirement DATA-003 (Session configuration), which deals with > >>>>>> the data channel requirement, include the following: > >>>>>> > >>>>>> DOTS server > >>>>>> implementations MUST have mechanisms to configure the > >> following: > >>>>>> * Acceptable signal lossiness, as described in GEN-002. > >>>>>> > >>>>>> * Heartbeat intervals, as described in OP-002. > >>>>>> > >>>>>> * Maximum mitigation lifetime, as described in OP-005. > >>>>>> > >>>>>> * Resource identifiers, as described in OP-006. > >>>>>> > >>>>>> > >>>>>> Resource identifier config makes sense to me, but why aren't the > >>>>>> first 3 simply part of the signal channel establishment procedure > >>>>>> (which would have the added benefit of allowing them to be > >>>>>> adjusted more easily later > >>>>>> on) ? > >>>>> Acceptable signal lossiness configuration helps determine the > >>>>> lossiness > >>>> parameters (e.g. max number of re-transmissions, max > >>>> re-transmission parameters etc.) for the first DOTS signal message. > >>>> The first DOTS signal message may convey new signal lossiness > >>>> configuration parameters for subsequent DOTS signal messages. > >>>>> Heartbeat intervals and Maximum mitigation lifetime configuration > >>>>> in DOTS > >>>> data channel can be treated as global configuration used for all > >>>> DOTS signal channels b/w DOTS agents, unless specifically > >>>> over-written by the DOTS signal channel. > >>>> Seems like more complexity than needed - I'd just have one set of > >>>> values in the protocol (signal channel). > >>> The advantage of the above approach is: setting the values in data > >>> channel > >> during peace time avoids the need to convey the configuration > >> parameters in the signal channel during DDoS attack. > >> You have to establish a bidirectional mutually authenticated signal > >> channel regardless, so at least one message needs to get through - > >> that message can simply set the value. > > That one message can convey the DOTS signal, and over-loading this requ= est > with additional configuration parameters will increase the complexity of > handling error conditions where the server may act on the DOTS signal but= the > configuration parameters may not be acceptable to the server. The > negotiation of the configuration may take multiple requests/responses and > may involve multiple re-transmissions during a DDOS attack. > > > >> As for having the same data conveyed via multiple avenues, it adds > >> additional complexity and leads to various inconsistency and race > >> condition issues you have to deal with. I'm not in favor of that > >> unless it adds substantial benefits, and I haven't seen those yet. > > The advantage is DOTS data channel will anyway be created during the > peacetime to create alias, it can also be used to negotiate configuration > parameters and can be used for all the DOTS signal channels. > > > > The message transmission parameters negotiated in DOTS data channel > during peace time can be used influence the max number of retransmissions= , > max retransmission span etc. for first DOTS signal message. > > > > I don't see a need to re-negotiate the configuration parameters in the = DOTS > signal channel during a DDOS attack. > > > >> Thanks > >> > >> -- Flemming > > . > > From nobody Tue Sep 27 17:30:16 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BCEF12B52D for ; Tue, 27 Sep 2016 17:30:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y_LXDVw88Ecb for ; Tue, 27 Sep 2016 17:30:12 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC8E112B042 for ; Tue, 27 Sep 2016 17:30:11 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml706-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CSA25597; Wed, 28 Sep 2016 00:30:09 +0000 (GMT) Received: from SZXEMA411-HUB.china.huawei.com (10.82.72.70) by lhreml706-cah.china.huawei.com (10.201.5.182) with Microsoft SMTP Server (TLS) id 14.3.235.1; Wed, 28 Sep 2016 01:30:08 +0100 Received: from SZXEMA502-MBS.china.huawei.com ([169.254.4.86]) by szxema411-hub.china.huawei.com ([10.82.72.70]) with mapi id 14.03.0235.001; Wed, 28 Sep 2016 08:30:06 +0800 From: "Xialiang (Frank)" To: "Tirumaleswar Reddy (tireddy)" , "Flemming Andreasen (fandreas)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t58Ph4uHS8s0qhMm1dtY/fhaCK+KyAgACWpICAAKoHAIAAh3qAgAAF9wCAABI6AIAABaGAgAEvfMA= Date: Wed, 28 Sep 2016 00:30:05 +0000 Message-ID: References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> <7606d458-6818-9246-b522-d90989ef110d@cisco.com> In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.135.43.91] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020205.57EB0F12.000B, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.4.86, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 174d38ad933c9b338d16424f4727aa4d Archived-At: Subject: [Dots] =?gb2312?b?tPC4tDogIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRBLTAw?= =?gb2312?b?MyBTZXNzaW9uIGNvbmZpZ3VyYXRpb24=?= X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Sep 2016 00:30:15 -0000 SGksDQoNCi0tLS0t08q8/tStvP4tLS0tLQ0Kt6K8/sjLOiBEb3RzIFttYWlsdG86ZG90cy1ib3Vu Y2VzQGlldGYub3JnXSC0+rHtIFRpcnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSkNCreiy83Ksbzk OiAyMDE2xOo51MIyN8jVIDIyOjE2DQrK1bz+yMs6IEZsZW1taW5nIEFuZHJlYXNlbiAoZmFuZHJl YXMpOyBkb3RzDQrW98ziOiBSZTogW0RvdHNdIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRBLTAwMyBT ZXNzaW9uIGNvbmZpZ3VyYXRpb24NCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBG cm9tOiBGbGVtbWluZyBBbmRyZWFzZW4gKGZhbmRyZWFzKQ0KPiBTZW50OiBUdWVzZGF5LCBTZXB0 ZW1iZXIgMjcsIDIwMTYgNzoyNiBQTQ0KPiBUbzogVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5 KSA8dGlyZWRkeUBjaXNjby5jb20+OyBkb3RzIA0KPiA8ZG90c0BpZXRmLm9yZz4NCj4gU3ViamVj dDogUmU6IFtEb3RzXSBET1RTIFJlcXVpcmVtZW50czogREFUQS0wMDMgU2Vzc2lvbiBjb25maWd1 cmF0aW9uDQo+IA0KPiBJIHRoaW5rIHdlIGhhdmUgZGlmZmVyZW50IHZpZXdzIG9mIHRoZSBET1RT IHdvcmxkIGhlcmUuIE15IHZpZXcgaXMgDQo+IHRoYXQgeW91IHN0YXJ0IGVzdGFibGlzaGluZyBh IHNpZ25hbCBjaGFubmVsLCBhbmQgeW91IG1heSBlc3RhYmxpc2ggYSANCj4gZGF0YSBjaGFubmVs IHRoYXQgb2NjYXNpb25hbGx5IGNhbiBiZSB1c2VkIHRvIGNvbnZleSB2YXJpb3VzIA0KPiBvcGVy YXRpb25hbGx5IHJlbGF0ZWQgcGFyYW1ldGVycywgc3VjaCBhcyB3aGl0ZWxpc3RzLCBibGFja2xp c3RzLCBmaWx0ZXJzLCBldGMuDQoNCkluIHZhcmlvdXMgc2NlbmFyaW9zLCBET1RTIGRhdGEgY2hh bm5lbCBpcyBzdXBwb3NlZCB0byBiZSBlc3RhYmxpc2hlZCBiZWZvcmUgRE9UUyBzaWduYWwgY2hh bm5lbCwgZm9yIGV4YW1wbGUgdG8gY3JlYXRlIGFsaWFzIGZvciByZXNvdXJjZXMuIA0KW0ZyYW5r XTogdGhlIHBvaW50IGlzIHNvbWUgY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzIGhhZCBiZXR0ZXIg YmUgZXhjaGFuZ2VkIGR1cmluZyB0aGUgcGVhY2V0aW1lLCB1c3VhbGx5IGJlZm9yZSB0aGUgc2ln bmFsaW5nIGNoYW5uZWwgaXMgZXN0YWJsaXNoZWQuIFVzaW5nIGRhdGEgY2hhbm5lbCBmb3IgdGhp cyBmdW5jdGlvbiBpcyByZWFzb25hYmxlIGFuZCBsb2dpY2FsbHkgY2xlYXIgZm9yIG1lLg0KDQo+ IFRoZSBzaWduYWwgY2hhbm5lbCBzaG91bGQgc3BlY2lmeSBob3cNCj4gdGhlIHNpZ25hbCBjaGFu bmVsIHdvcmtzIGFzIHBhcnQgb2YgdGhlIHNpZ25hbCBjaGFubmVsIGVzdGFibGlzaG1lbnQ7IA0K PiB0aGF0IGluY2x1ZGVzIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycywgZXh0ZW5zaW9ucyBzdXBw b3J0ZWQsIGV0Yy4NCj4gDQo+IE5vIERPVFMgc2lnbmFsIGNoYW5uZWwgPT4gbm8gRE9UUyBvcGVy YXRpb24uDQo+IE5vIERPVFMgZGF0YSBjaGFubmVsIGRvZXMgbm90IG5lY2Vzc2FyaWx5IGltcGx5 IHRoZSBzYW1lLg0KPiANCj4gQXMgdG8gYXJndW1lbnRzIGFyb3VuZCB0aGUgZGF0YSBjaGFubmVs IGJlaW5nIHRoZSBiZXR0ZXIgcGxhY2UgdG8gDQo+IG5lZ290aWF0ZSB0aGluZ3MgYmVjYXVzZSBp dCdzIHVzZWQgZHVyaW5nIHBlYWNlLXRpbWUsIGl0J3MgYSByZWQgDQo+IGhlcnJpbmcgYmVjYXVz ZSB0aGUgc2lnbmFsIGNoYW5uZWwgd2lsbCBvYnZpb3VzbHkgd29yayBqdXN0IGFzIHdlbGwgaW4g DQo+IHBlYWNlLXRpbWUuIE5vdywgSSBhZ3JlZSwgd2Ugc2hvdWxkJ24ndCByZW5lZ290aWF0ZSB0 aGUgcGFyYW1ldGVycyBpbiANCj4gcXVlc3Rpb24gZHVyaW5nIGFuIGF0dGFjaywgYnV0IGFnYWlu LCBpdCdzIG9ydGhvZ29uYWwgdG8gd2hldGhlciB0aGF0IA0KPiBpcyBkb25lIGluIHRoZSBzaWdu YWwgb3IgZGF0YSBjaGFubmVsIC0gaWYgYW55dGhpbmcsIHRoZSBkYXRhIGNoYW5uZWwgDQo+IHdv dWxkIGhhdmUgYSBtdWNoIGxvd2VyIGNoYW5jZSBvZiB3b3JraW5nIGR1cmluZyBhbiBhY3RpdmUg RERvUyBhdHRhY2suDQoNClllcywgRE9UUyBkYXRhIGNoYW5uZWwgaXMgZXhwZWN0ZWQgdG8gYmUg dXNlZCBvbmx5IGR1cmluZyBwZWFjZXRpbWUuIA0KSWYgd2UgYWdyZWUgdGhhdCBjb25maWd1cmF0 aW9uIHBhcmFtZXRlcnMgc2hvdWxkIGJlIG5lZ290aWF0ZWQgZHVyaW5nIHBlYWNldGltZSB0aGVu IHVzaW5nIERPVFMgc2lnbmFsIGNoYW5uZWwgdG8gbmVnb3RpYXRlIHRoZW0gd29ya3MgZm9yIG1l Lg0KW0ZyYW5rXTogZGlzYWdyZWUsIGl0IGlzIG5vdCBuZWNlc3NhcnkgYW5kIHdpbGwgaW5mbHVl bmNlIHRoZSBleGlzdGluZyBET1RTIGFyY2hpdGVjdHVyZS4NCg0KQi5SLg0KRnJhbmsNCg0KLVRp cnUNCg0KPiANCj4gVGhhbmtzDQo+IA0KPiAtLSBGbGVtbWluZw0KPiANCj4gDQo+IE9uIDkvMjcv MTYgODo1MCBBTSwgVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KSB3cm90ZToNCj4gPj4gLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gPj4gRnJvbTogRmxlbW1pbmcgQW5kcmVhc2VuIChm YW5kcmVhcykNCj4gPj4gU2VudDogVHVlc2RheSwgU2VwdGVtYmVyIDI3LCAyMDE2IDU6NTkgUE0N Cj4gPj4gVG86IFRpcnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSkgPHRpcmVkZHlAY2lzY28uY29t PjsgZG90cyANCj4gPj4gPGRvdHNAaWV0Zi5vcmc+DQo+ID4+IFN1YmplY3Q6IFJlOiBbRG90c10g RE9UUyBSZXF1aXJlbWVudHM6IERBVEEtMDAzIFNlc3Npb24gDQo+ID4+IGNvbmZpZ3VyYXRpb24N Cj4gPj4NCj4gPj4NCj4gPj4NCj4gPj4gT24gOS8yNy8xNiAxMjoyNCBBTSwgVGlydW1hbGVzd2Fy IFJlZGR5ICh0aXJlZGR5KSB3cm90ZToNCj4gPj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LQ0KPiA+Pj4+IEZyb206IEZsZW1taW5nIEFuZHJlYXNlbiAoZmFuZHJlYXMpDQo+ID4+Pj4gU2Vu dDogTW9uZGF5LCBTZXB0ZW1iZXIgMjYsIDIwMTYgMTE6NDYgUE0NCj4gPj4+PiBUbzogVGlydW1h bGVzd2FyIFJlZGR5ICh0aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb20+OyBkb3RzIA0KPiA+Pj4+ IDxkb3RzQGlldGYub3JnPg0KPiA+Pj4+IFN1YmplY3Q6IFJlOiBbRG90c10gRE9UUyBSZXF1aXJl bWVudHM6IERBVEEtMDAzIFNlc3Npb24gDQo+ID4+Pj4gY29uZmlndXJhdGlvbg0KPiA+Pj4+DQo+ ID4+Pj4NCj4gPj4+Pg0KPiA+Pj4+IE9uIDkvMjYvMTYgNToxNiBBTSwgVGlydW1hbGVzd2FyIFJl ZGR5ICh0aXJlZGR5KSB3cm90ZToNCj4gPj4+Pj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t DQo+ID4+Pj4+PiBGcm9tOiBEb3RzIFttYWlsdG86ZG90cy1ib3VuY2VzQGlldGYub3JnXSBPbiBC ZWhhbGYgT2YgRmxlbW1pbmcgDQo+ID4+Pj4+PiBBbmRyZWFzZW4NCj4gPj4+Pj4+IChmYW5kcmVh cykNCj4gPj4+Pj4+IFNlbnQ6IFN1bmRheSwgU2VwdGVtYmVyIDI1LCAyMDE2IDEwOjEwIFBNDQo+ ID4+Pj4+PiBUbzogZG90cyA8ZG90c0BpZXRmLm9yZz4NCj4gPj4+Pj4+IFN1YmplY3Q6IFtEb3Rz XSBET1RTIFJlcXVpcmVtZW50czogREFUQS0wMDMgU2Vzc2lvbiANCj4gPj4+Pj4+IGNvbmZpZ3Vy YXRpb24NCj4gPj4+Pj4+DQo+ID4+Pj4+PiBSZXF1aXJlbWVudCBEQVRBLTAwMyAoU2Vzc2lvbiBj b25maWd1cmF0aW9uKSwgd2hpY2ggZGVhbHMgd2l0aCANCj4gPj4+Pj4+IHRoZSBkYXRhIGNoYW5u ZWwgcmVxdWlyZW1lbnQsIGluY2x1ZGUgdGhlICBmb2xsb3dpbmc6DQo+ID4+Pj4+PiA8cXVvdGU+ DQo+ID4+Pj4+PiBET1RTIHNlcnZlcg0KPiA+Pj4+Pj4gICAgICAgICAgIGltcGxlbWVudGF0aW9u cyBNVVNUIGhhdmUgbWVjaGFuaXNtcyB0byBjb25maWd1cmUgdGhlDQo+ID4+IGZvbGxvd2luZzoN Cj4gPj4+Pj4+ICAgICAgICAgICAqICBBY2NlcHRhYmxlIHNpZ25hbCBsb3NzaW5lc3MsIGFzIGRl c2NyaWJlZCBpbiBHRU4tMDAyLg0KPiA+Pj4+Pj4NCj4gPj4+Pj4+ICAgICAgICAgICAqICBIZWFy dGJlYXQgaW50ZXJ2YWxzLCBhcyBkZXNjcmliZWQgaW4gT1AtMDAyLg0KPiA+Pj4+Pj4NCj4gPj4+ Pj4+ICAgICAgICAgICAqICBNYXhpbXVtIG1pdGlnYXRpb24gbGlmZXRpbWUsIGFzIGRlc2NyaWJl ZCBpbiBPUC0wMDUuDQo+ID4+Pj4+Pg0KPiA+Pj4+Pj4gICAgICAgICAgICogIFJlc291cmNlIGlk ZW50aWZpZXJzLCBhcyBkZXNjcmliZWQgaW4gT1AtMDA2Lg0KPiA+Pj4+Pj4gPC9xdW90ZT4NCj4g Pj4+Pj4+DQo+ID4+Pj4+PiBSZXNvdXJjZSBpZGVudGlmaWVyIGNvbmZpZyBtYWtlcyBzZW5zZSB0 byBtZSwgYnV0IHdoeSBhcmVuJ3QgDQo+ID4+Pj4+PiB0aGUgZmlyc3QgMyBzaW1wbHkgcGFydCBv ZiB0aGUgc2lnbmFsIGNoYW5uZWwgZXN0YWJsaXNobWVudCANCj4gPj4+Pj4+IHByb2NlZHVyZSAo d2hpY2ggd291bGQgaGF2ZSB0aGUgYWRkZWQgYmVuZWZpdCBvZiBhbGxvd2luZyB0aGVtIA0KPiA+ Pj4+Pj4gdG8gYmUgYWRqdXN0ZWQgbW9yZSBlYXNpbHkgbGF0ZXINCj4gPj4+Pj4+IG9uKSA/DQo+ ID4+Pj4+IEFjY2VwdGFibGUgc2lnbmFsIGxvc3NpbmVzcyBjb25maWd1cmF0aW9uIGhlbHBzIGRl dGVybWluZSB0aGUgDQo+ID4+Pj4+IGxvc3NpbmVzcw0KPiA+Pj4+IHBhcmFtZXRlcnMgKGUuZy4g bWF4IG51bWJlciBvZiByZS10cmFuc21pc3Npb25zLCBtYXggDQo+ID4+Pj4gcmUtdHJhbnNtaXNz aW9uIHBhcmFtZXRlcnMgZXRjLikgZm9yIHRoZSBmaXJzdCBET1RTIHNpZ25hbCBtZXNzYWdlLg0K PiA+Pj4+IFRoZSBmaXJzdCBET1RTIHNpZ25hbCBtZXNzYWdlIG1heSBjb252ZXkgbmV3IHNpZ25h bCBsb3NzaW5lc3MgDQo+ID4+Pj4gY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzIGZvciBzdWJzZXF1 ZW50IERPVFMgc2lnbmFsIG1lc3NhZ2VzLg0KPiA+Pj4+PiBIZWFydGJlYXQgaW50ZXJ2YWxzIGFu ZCBNYXhpbXVtIG1pdGlnYXRpb24gbGlmZXRpbWUgDQo+ID4+Pj4+IGNvbmZpZ3VyYXRpb24gaW4g RE9UUw0KPiA+Pj4+IGRhdGEgY2hhbm5lbCBjYW4gYmUgdHJlYXRlZCBhcyBnbG9iYWwgY29uZmln dXJhdGlvbiB1c2VkIGZvciBhbGwgDQo+ID4+Pj4gRE9UUyBzaWduYWwgY2hhbm5lbHMgYi93IERP VFMgYWdlbnRzLCB1bmxlc3Mgc3BlY2lmaWNhbGx5IA0KPiA+Pj4+IG92ZXItd3JpdHRlbiBieSB0 aGUgRE9UUyBzaWduYWwgY2hhbm5lbC4NCj4gPj4+PiBTZWVtcyBsaWtlIG1vcmUgY29tcGxleGl0 eSB0aGFuIG5lZWRlZCAtIEknZCBqdXN0IGhhdmUgb25lIHNldCBvZiANCj4gPj4+PiB2YWx1ZXMg aW4gdGhlIHByb3RvY29sIChzaWduYWwgY2hhbm5lbCkuDQo+ID4+PiBUaGUgYWR2YW50YWdlIG9m IHRoZSBhYm92ZSBhcHByb2FjaCBpczogc2V0dGluZyB0aGUgdmFsdWVzIGluIGRhdGEgDQo+ID4+ PiBjaGFubmVsDQo+ID4+IGR1cmluZyBwZWFjZSB0aW1lIGF2b2lkcyB0aGUgbmVlZCB0byBjb252 ZXkgdGhlIGNvbmZpZ3VyYXRpb24gDQo+ID4+IHBhcmFtZXRlcnMgaW4gdGhlIHNpZ25hbCBjaGFu bmVsIGR1cmluZyBERG9TIGF0dGFjay4NCj4gPj4gWW91IGhhdmUgdG8gZXN0YWJsaXNoIGEgYmlk aXJlY3Rpb25hbCBtdXR1YWxseSBhdXRoZW50aWNhdGVkIHNpZ25hbCANCj4gPj4gY2hhbm5lbCBy ZWdhcmRsZXNzLCBzbyBhdCBsZWFzdCBvbmUgbWVzc2FnZSBuZWVkcyB0byBnZXQgdGhyb3VnaCAt IA0KPiA+PiB0aGF0IG1lc3NhZ2UgY2FuIHNpbXBseSBzZXQgdGhlIHZhbHVlLg0KPiA+IFRoYXQg b25lIG1lc3NhZ2UgY2FuIGNvbnZleSB0aGUgRE9UUyBzaWduYWwsIGFuZCBvdmVyLWxvYWRpbmcg dGhpcyANCj4gPiByZXF1ZXN0DQo+IHdpdGggYWRkaXRpb25hbCBjb25maWd1cmF0aW9uIHBhcmFt ZXRlcnMgd2lsbCBpbmNyZWFzZSB0aGUgY29tcGxleGl0eSANCj4gb2YgaGFuZGxpbmcgZXJyb3Ig Y29uZGl0aW9ucyB3aGVyZSB0aGUgc2VydmVyIG1heSBhY3Qgb24gdGhlIERPVFMgDQo+IHNpZ25h bCBidXQgdGhlIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBtYXkgbm90IGJlIGFjY2VwdGFibGUg dG8gdGhlIA0KPiBzZXJ2ZXIuICBUaGUgbmVnb3RpYXRpb24gb2YgdGhlIGNvbmZpZ3VyYXRpb24g bWF5IHRha2UgbXVsdGlwbGUgDQo+IHJlcXVlc3RzL3Jlc3BvbnNlcyBhbmQgbWF5IGludm9sdmUg bXVsdGlwbGUgcmUtdHJhbnNtaXNzaW9ucyBkdXJpbmcgYSBERE9TIGF0dGFjay4NCj4gPg0KPiA+ PiBBcyBmb3IgaGF2aW5nIHRoZSBzYW1lIGRhdGEgY29udmV5ZWQgdmlhIG11bHRpcGxlIGF2ZW51 ZXMsIGl0IGFkZHMgDQo+ID4+IGFkZGl0aW9uYWwgY29tcGxleGl0eSBhbmQgbGVhZHMgdG8gdmFy aW91cyBpbmNvbnNpc3RlbmN5IGFuZCByYWNlIA0KPiA+PiBjb25kaXRpb24gaXNzdWVzIHlvdSBo YXZlIHRvIGRlYWwgd2l0aC4gSSdtIG5vdCBpbiBmYXZvciBvZiB0aGF0IA0KPiA+PiB1bmxlc3Mg aXQgYWRkcyBzdWJzdGFudGlhbCBiZW5lZml0cywgYW5kIEkgaGF2ZW4ndCBzZWVuIHRob3NlIHll dC4NCj4gPiBUaGUgYWR2YW50YWdlIGlzIERPVFMgZGF0YSBjaGFubmVsIHdpbGwgYW55d2F5IGJl IGNyZWF0ZWQgZHVyaW5nIHRoZQ0KPiBwZWFjZXRpbWUgdG8gY3JlYXRlIGFsaWFzLCBpdCBjYW4g YWxzbyBiZSB1c2VkIHRvIG5lZ290aWF0ZSANCj4gY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzIGFu ZCBjYW4gYmUgdXNlZCBmb3IgYWxsIHRoZSBET1RTIHNpZ25hbCBjaGFubmVscy4NCj4gPg0KPiA+ IFRoZSBtZXNzYWdlIHRyYW5zbWlzc2lvbiBwYXJhbWV0ZXJzIG5lZ290aWF0ZWQgaW4gRE9UUyBk YXRhIGNoYW5uZWwNCj4gZHVyaW5nIHBlYWNlIHRpbWUgY2FuIGJlIHVzZWQgaW5mbHVlbmNlIHRo ZSBtYXggbnVtYmVyIG9mIA0KPiByZXRyYW5zbWlzc2lvbnMsIG1heCByZXRyYW5zbWlzc2lvbiBz cGFuIGV0Yy4gZm9yIGZpcnN0IERPVFMgc2lnbmFsIG1lc3NhZ2UuDQo+ID4NCj4gPiBJIGRvbid0 IHNlZSBhIG5lZWQgdG8gcmUtbmVnb3RpYXRlIHRoZSBjb25maWd1cmF0aW9uIHBhcmFtZXRlcnMg aW4gDQo+ID4gdGhlIERPVFMNCj4gc2lnbmFsIGNoYW5uZWwgZHVyaW5nIGEgRERPUyBhdHRhY2su DQo+ID4NCj4gPj4gVGhhbmtzDQo+ID4+DQo+ID4+IC0tIEZsZW1taW5nDQo+ID4gLg0KPiA+DQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpEb3RzIG1h aWxpbmcgbGlzdA0KRG90c0BpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9kb3RzDQo= From nobody Wed Sep 28 19:37:42 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5B9212B2AC for ; Wed, 28 Sep 2016 19:37:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lJib1slZxf2P for ; Wed, 28 Sep 2016 19:37:35 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9248112B23C for ; Wed, 28 Sep 2016 19:37:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11212; q=dns/txt; s=iport; t=1475116655; x=1476326255; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=Jh3F6nJLUykLAnKYBpAHhCymMpVPZMnzhOzj2aWbssY=; b=CSCEm2O3TBK5ofuiQ30idFdqz+ZSAB2IEQsIyyV/ja+jmO1UqWQRoXuS snSxVGOR1ZKd95+NTpQtac+iASzPY38iYSoJaFSe4FB9STXMj67fHOfgH FhksO0n1zFtq4ateO836clseYnnr2D4zgfqnZ5aKjNMjYBd4vxeSneesq A=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AbAQCqfexX/4sNJK1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgz8BAQEBAR5XfAeNK6seggYZC4V6AhyBQzgUAQIBAQEBAQEBXie?= =?us-ascii?q?EYQEBAQMBAQEBMToXBAIBBgIRAQMBAQEEIwUCAiULFAMGCAIEARIIiD0IDpFSn?= =?us-ascii?q?SAIjHoBAQEBAQEBAQEBAQEBAQEBAQEBAQEXBYEChTWEVIE8gnItgmmCXgEEmXc?= =?us-ascii?q?Bj2iBdY1/hwqFY4N8AR42hQlyhnyBAAEBAQ?= X-IronPort-AV: E=Sophos;i="5.30,413,1470700800"; d="scan'208";a="152049129" Received: from alln-core-6.cisco.com ([173.36.13.139]) by rcdn-iport-9.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 29 Sep 2016 02:37:34 +0000 Received: from XCH-ALN-003.cisco.com (xch-aln-003.cisco.com [173.36.7.13]) by alln-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id u8T2bX2L015758 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 29 Sep 2016 02:37:34 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-ALN-003.cisco.com (173.36.7.13) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 28 Sep 2016 21:36:49 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Wed, 28 Sep 2016 21:36:48 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "Xialiang (Frank)" , "Flemming Andreasen (fandreas)" , dots Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t2dIO+nOpgDkqGMN/GY7dXeaCLeGWwgADw2YCAAFQTwIAA3W6A//+theCAAGqsAP//rNowgAEEW4CAACVlIA== Date: Thu, 29 Sep 2016 02:36:48 +0000 Message-ID: <4668d5bb12d64854aa8ad75b57f5179d@XCH-RCD-017.cisco.com> References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> <7606d458-6818-9246-b522-d90989ef110d@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.65.79.232] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Dots] DOTS Requirements: DATA-003 Session configuration X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2016 02:37:38 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBYaWFsaWFuZyAoRnJhbmspIFtt YWlsdG86ZnJhbmsueGlhbGlhbmdAaHVhd2VpLmNvbV0NCj4gU2VudDogV2VkbmVzZGF5LCBTZXB0 ZW1iZXIgMjgsIDIwMTYgNjowMCBBTQ0KPiBUbzogVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5 KSA8dGlyZWRkeUBjaXNjby5jb20+OyBGbGVtbWluZyBBbmRyZWFzZW4NCj4gKGZhbmRyZWFzKSA8 ZmFuZHJlYXNAY2lzY28uY29tPjsgZG90cyA8ZG90c0BpZXRmLm9yZz4NCj4gU3ViamVjdDogtPC4 tDogW0RvdHNdIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRBLTAwMyBTZXNzaW9uIGNvbmZpZ3VyYXRp b24NCj4gDQo+IEhpLA0KPiANCj4gLS0tLS3Tyrz+1K28/i0tLS0tDQo+ILeivP7IyzogRG90cyBb bWFpbHRvOmRvdHMtYm91bmNlc0BpZXRmLm9yZ10gtPqx7SBUaXJ1bWFsZXN3YXIgUmVkZHkNCj4g KHRpcmVkZHkpDQo+ILeiy83KsbzkOiAyMDE2xOo51MIyN8jVIDIyOjE2DQo+IMrVvP7IyzogRmxl bW1pbmcgQW5kcmVhc2VuIChmYW5kcmVhcyk7IGRvdHMNCj4g1vfM4jogUmU6IFtEb3RzXSBET1RT IFJlcXVpcmVtZW50czogREFUQS0wMDMgU2Vzc2lvbiBjb25maWd1cmF0aW9uDQo+IA0KPiA+IC0t LS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+ID4gRnJvbTogRmxlbW1pbmcgQW5kcmVhc2VuIChm YW5kcmVhcykNCj4gPiBTZW50OiBUdWVzZGF5LCBTZXB0ZW1iZXIgMjcsIDIwMTYgNzoyNiBQTQ0K PiA+IFRvOiBUaXJ1bWFsZXN3YXIgUmVkZHkgKHRpcmVkZHkpIDx0aXJlZGR5QGNpc2NvLmNvbT47 IGRvdHMNCj4gPiA8ZG90c0BpZXRmLm9yZz4NCj4gPiBTdWJqZWN0OiBSZTogW0RvdHNdIERPVFMg UmVxdWlyZW1lbnRzOiBEQVRBLTAwMyBTZXNzaW9uIGNvbmZpZ3VyYXRpb24NCj4gPg0KPiA+IEkg dGhpbmsgd2UgaGF2ZSBkaWZmZXJlbnQgdmlld3Mgb2YgdGhlIERPVFMgd29ybGQgaGVyZS4gTXkg dmlldyBpcw0KPiA+IHRoYXQgeW91IHN0YXJ0IGVzdGFibGlzaGluZyBhIHNpZ25hbCBjaGFubmVs LCBhbmQgeW91IG1heSBlc3RhYmxpc2ggYQ0KPiA+IGRhdGEgY2hhbm5lbCB0aGF0IG9jY2FzaW9u YWxseSBjYW4gYmUgdXNlZCB0byBjb252ZXkgdmFyaW91cw0KPiA+IG9wZXJhdGlvbmFsbHkgcmVs YXRlZCBwYXJhbWV0ZXJzLCBzdWNoIGFzIHdoaXRlbGlzdHMsIGJsYWNrbGlzdHMsIGZpbHRlcnMs IGV0Yy4NCj4gDQo+IEluIHZhcmlvdXMgc2NlbmFyaW9zLCBET1RTIGRhdGEgY2hhbm5lbCBpcyBz dXBwb3NlZCB0byBiZSBlc3RhYmxpc2hlZCBiZWZvcmUNCj4gRE9UUyBzaWduYWwgY2hhbm5lbCwg Zm9yIGV4YW1wbGUgdG8gY3JlYXRlIGFsaWFzIGZvciByZXNvdXJjZXMuDQo+IFtGcmFua106IHRo ZSBwb2ludCBpcyBzb21lIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBoYWQgYmV0dGVyIGJlIGV4 Y2hhbmdlZA0KPiBkdXJpbmcgdGhlIHBlYWNldGltZSwgdXN1YWxseSBiZWZvcmUgdGhlIHNpZ25h bGluZyBjaGFubmVsIGlzIGVzdGFibGlzaGVkLg0KPiBVc2luZyBkYXRhIGNoYW5uZWwgZm9yIHRo aXMgZnVuY3Rpb24gaXMgcmVhc29uYWJsZSBhbmQgbG9naWNhbGx5IGNsZWFyIGZvciBtZS4NCj4g DQo+ID4gVGhlIHNpZ25hbCBjaGFubmVsIHNob3VsZCBzcGVjaWZ5IGhvdw0KPiA+IHRoZSBzaWdu YWwgY2hhbm5lbCB3b3JrcyBhcyBwYXJ0IG9mIHRoZSBzaWduYWwgY2hhbm5lbCBlc3RhYmxpc2ht ZW50Ow0KPiA+IHRoYXQgaW5jbHVkZXMgY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzLCBleHRlbnNp b25zIHN1cHBvcnRlZCwgZXRjLg0KPiA+DQo+ID4gTm8gRE9UUyBzaWduYWwgY2hhbm5lbCA9PiBu byBET1RTIG9wZXJhdGlvbi4NCj4gPiBObyBET1RTIGRhdGEgY2hhbm5lbCBkb2VzIG5vdCBuZWNl c3NhcmlseSBpbXBseSB0aGUgc2FtZS4NCj4gPg0KPiA+IEFzIHRvIGFyZ3VtZW50cyBhcm91bmQg dGhlIGRhdGEgY2hhbm5lbCBiZWluZyB0aGUgYmV0dGVyIHBsYWNlIHRvDQo+ID4gbmVnb3RpYXRl IHRoaW5ncyBiZWNhdXNlIGl0J3MgdXNlZCBkdXJpbmcgcGVhY2UtdGltZSwgaXQncyBhIHJlZA0K PiA+IGhlcnJpbmcgYmVjYXVzZSB0aGUgc2lnbmFsIGNoYW5uZWwgd2lsbCBvYnZpb3VzbHkgd29y ayBqdXN0IGFzIHdlbGwgaW4NCj4gPiBwZWFjZS10aW1lLiBOb3csIEkgYWdyZWUsIHdlIHNob3Vs ZCduJ3QgcmVuZWdvdGlhdGUgdGhlIHBhcmFtZXRlcnMgaW4NCj4gPiBxdWVzdGlvbiBkdXJpbmcg YW4gYXR0YWNrLCBidXQgYWdhaW4sIGl0J3Mgb3J0aG9nb25hbCB0byB3aGV0aGVyIHRoYXQNCj4g PiBpcyBkb25lIGluIHRoZSBzaWduYWwgb3IgZGF0YSBjaGFubmVsIC0gaWYgYW55dGhpbmcsIHRo ZSBkYXRhIGNoYW5uZWwNCj4gPiB3b3VsZCBoYXZlIGEgbXVjaCBsb3dlciBjaGFuY2Ugb2Ygd29y a2luZyBkdXJpbmcgYW4gYWN0aXZlIEREb1MgYXR0YWNrLg0KPiANCj4gWWVzLCBET1RTIGRhdGEg Y2hhbm5lbCBpcyBleHBlY3RlZCB0byBiZSB1c2VkIG9ubHkgZHVyaW5nIHBlYWNldGltZS4NCj4g SWYgd2UgYWdyZWUgdGhhdCBjb25maWd1cmF0aW9uIHBhcmFtZXRlcnMgc2hvdWxkIGJlIG5lZ290 aWF0ZWQgZHVyaW5nDQo+IHBlYWNldGltZSB0aGVuIHVzaW5nIERPVFMgc2lnbmFsIGNoYW5uZWwg dG8gbmVnb3RpYXRlIHRoZW0gd29ya3MgZm9yIG1lLg0KPiBbRnJhbmtdOiBkaXNhZ3JlZSwgaXQg aXMgbm90IG5lY2Vzc2FyeSBhbmQgd2lsbCBpbmZsdWVuY2UgdGhlIGV4aXN0aW5nIERPVFMNCj4g YXJjaGl0ZWN0dXJlLg0KDQpET1RTIGRhdGEgY2hhbm5lbCB3aWxsIHN0aWxsIGJlIHVzZWQgZm9y IG90aGVyIGNvbmZpZ3VyYXRpb24gbGlrZSBmaWx0ZXJzLCBhbGlhcyBldGMuIFRoZSByZWFzb24g Zm9yIG1vdmluZyB0aGVzZSBjb25maWd1cmF0aW9uIHBhcmFtZXRlcnMgYXJlIHRoYXQgdGhlIERP VFMgc2lnbmFsIGNoYW5uZWwgbWF5IHdhbnQgdG8gbGF0ZXIgdXBkYXRlIGl0IGJhc2VkIG9uIHRo ZSBuZXR3b3JrIGNvbmRpdGlvbnMgYW5kIGl0J3MgYmV0dGVyIHRvIG5lZ290aWF0ZSB0aGVtIGlu IG9uZSBjaGFubmVsIGFuZCBub3QgbXVsdGlwbGUgY2hhbm5lbHMuIA0KDQpXaHkgZG8geW91IHRo aW5rIGl0IGlzIG5vdCBuZWNlc3NhcnkgYW5kIHdpbGwgaW1wYWN0IHRoZSBET1RTIGFyY2hpdGVj dHVyZSBhZHZlcnNlbHkgPw0KDQotVGlydQ0KDQo+IA0KPiBCLlIuDQo+IEZyYW5rDQo+IA0KPiAt VGlydQ0KPiANCj4gPg0KPiA+IFRoYW5rcw0KPiA+DQo+ID4gLS0gRmxlbW1pbmcNCj4gPg0KPiA+ DQo+ID4gT24gOS8yNy8xNiA4OjUwIEFNLCBUaXJ1bWFsZXN3YXIgUmVkZHkgKHRpcmVkZHkpIHdy b3RlOg0KPiA+ID4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+ID4gPj4gRnJvbTogRmxl bW1pbmcgQW5kcmVhc2VuIChmYW5kcmVhcykNCj4gPiA+PiBTZW50OiBUdWVzZGF5LCBTZXB0ZW1i ZXIgMjcsIDIwMTYgNTo1OSBQTQ0KPiA+ID4+IFRvOiBUaXJ1bWFsZXN3YXIgUmVkZHkgKHRpcmVk ZHkpIDx0aXJlZGR5QGNpc2NvLmNvbT47IGRvdHMNCj4gPiA+PiA8ZG90c0BpZXRmLm9yZz4NCj4g PiA+PiBTdWJqZWN0OiBSZTogW0RvdHNdIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRBLTAwMyBTZXNz aW9uDQo+ID4gPj4gY29uZmlndXJhdGlvbg0KPiA+ID4+DQo+ID4gPj4NCj4gPiA+Pg0KPiA+ID4+ IE9uIDkvMjcvMTYgMTI6MjQgQU0sIFRpcnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSkgd3JvdGU6 DQo+ID4gPj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiA+ID4+Pj4gRnJvbTogRmxl bW1pbmcgQW5kcmVhc2VuIChmYW5kcmVhcykNCj4gPiA+Pj4+IFNlbnQ6IE1vbmRheSwgU2VwdGVt YmVyIDI2LCAyMDE2IDExOjQ2IFBNDQo+ID4gPj4+PiBUbzogVGlydW1hbGVzd2FyIFJlZGR5ICh0 aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb20+OyBkb3RzDQo+ID4gPj4+PiA8ZG90c0BpZXRmLm9y Zz4NCj4gPiA+Pj4+IFN1YmplY3Q6IFJlOiBbRG90c10gRE9UUyBSZXF1aXJlbWVudHM6IERBVEEt MDAzIFNlc3Npb24NCj4gPiA+Pj4+IGNvbmZpZ3VyYXRpb24NCj4gPiA+Pj4+DQo+ID4gPj4+Pg0K PiA+ID4+Pj4NCj4gPiA+Pj4+IE9uIDkvMjYvMTYgNToxNiBBTSwgVGlydW1hbGVzd2FyIFJlZGR5 ICh0aXJlZGR5KSB3cm90ZToNCj4gPiA+Pj4+Pj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0N Cj4gPiA+Pj4+Pj4gRnJvbTogRG90cyBbbWFpbHRvOmRvdHMtYm91bmNlc0BpZXRmLm9yZ10gT24g QmVoYWxmIE9mIEZsZW1taW5nDQo+ID4gPj4+Pj4+IEFuZHJlYXNlbg0KPiA+ID4+Pj4+PiAoZmFu ZHJlYXMpDQo+ID4gPj4+Pj4+IFNlbnQ6IFN1bmRheSwgU2VwdGVtYmVyIDI1LCAyMDE2IDEwOjEw IFBNDQo+ID4gPj4+Pj4+IFRvOiBkb3RzIDxkb3RzQGlldGYub3JnPg0KPiA+ID4+Pj4+PiBTdWJq ZWN0OiBbRG90c10gRE9UUyBSZXF1aXJlbWVudHM6IERBVEEtMDAzIFNlc3Npb24NCj4gPiA+Pj4+ Pj4gY29uZmlndXJhdGlvbg0KPiA+ID4+Pj4+Pg0KPiA+ID4+Pj4+PiBSZXF1aXJlbWVudCBEQVRB LTAwMyAoU2Vzc2lvbiBjb25maWd1cmF0aW9uKSwgd2hpY2ggZGVhbHMgd2l0aA0KPiA+ID4+Pj4+ PiB0aGUgZGF0YSBjaGFubmVsIHJlcXVpcmVtZW50LCBpbmNsdWRlIHRoZSAgZm9sbG93aW5nOg0K PiA+ID4+Pj4+PiA8cXVvdGU+DQo+ID4gPj4+Pj4+IERPVFMgc2VydmVyDQo+ID4gPj4+Pj4+ICAg ICAgICAgICBpbXBsZW1lbnRhdGlvbnMgTVVTVCBoYXZlIG1lY2hhbmlzbXMgdG8gY29uZmlndXJl IHRoZQ0KPiA+ID4+IGZvbGxvd2luZzoNCj4gPiA+Pj4+Pj4gICAgICAgICAgICogIEFjY2VwdGFi bGUgc2lnbmFsIGxvc3NpbmVzcywgYXMgZGVzY3JpYmVkIGluIEdFTi0wMDIuDQo+ID4gPj4+Pj4+ DQo+ID4gPj4+Pj4+ICAgICAgICAgICAqICBIZWFydGJlYXQgaW50ZXJ2YWxzLCBhcyBkZXNjcmli ZWQgaW4gT1AtMDAyLg0KPiA+ID4+Pj4+Pg0KPiA+ID4+Pj4+PiAgICAgICAgICAgKiAgTWF4aW11 bSBtaXRpZ2F0aW9uIGxpZmV0aW1lLCBhcyBkZXNjcmliZWQgaW4gT1AtMDA1Lg0KPiA+ID4+Pj4+ Pg0KPiA+ID4+Pj4+PiAgICAgICAgICAgKiAgUmVzb3VyY2UgaWRlbnRpZmllcnMsIGFzIGRlc2Ny aWJlZCBpbiBPUC0wMDYuDQo+ID4gPj4+Pj4+IDwvcXVvdGU+DQo+ID4gPj4+Pj4+DQo+ID4gPj4+ Pj4+IFJlc291cmNlIGlkZW50aWZpZXIgY29uZmlnIG1ha2VzIHNlbnNlIHRvIG1lLCBidXQgd2h5 IGFyZW4ndA0KPiA+ID4+Pj4+PiB0aGUgZmlyc3QgMyBzaW1wbHkgcGFydCBvZiB0aGUgc2lnbmFs IGNoYW5uZWwgZXN0YWJsaXNobWVudA0KPiA+ID4+Pj4+PiBwcm9jZWR1cmUgKHdoaWNoIHdvdWxk IGhhdmUgdGhlIGFkZGVkIGJlbmVmaXQgb2YgYWxsb3dpbmcgdGhlbQ0KPiA+ID4+Pj4+PiB0byBi ZSBhZGp1c3RlZCBtb3JlIGVhc2lseSBsYXRlcg0KPiA+ID4+Pj4+PiBvbikgPw0KPiA+ID4+Pj4+ IEFjY2VwdGFibGUgc2lnbmFsIGxvc3NpbmVzcyBjb25maWd1cmF0aW9uIGhlbHBzIGRldGVybWlu ZSB0aGUNCj4gPiA+Pj4+PiBsb3NzaW5lc3MNCj4gPiA+Pj4+IHBhcmFtZXRlcnMgKGUuZy4gbWF4 IG51bWJlciBvZiByZS10cmFuc21pc3Npb25zLCBtYXgNCj4gPiA+Pj4+IHJlLXRyYW5zbWlzc2lv biBwYXJhbWV0ZXJzIGV0Yy4pIGZvciB0aGUgZmlyc3QgRE9UUyBzaWduYWwgbWVzc2FnZS4NCj4g PiA+Pj4+IFRoZSBmaXJzdCBET1RTIHNpZ25hbCBtZXNzYWdlIG1heSBjb252ZXkgbmV3IHNpZ25h bCBsb3NzaW5lc3MNCj4gPiA+Pj4+IGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBmb3Igc3Vic2Vx dWVudCBET1RTIHNpZ25hbCBtZXNzYWdlcy4NCj4gPiA+Pj4+PiBIZWFydGJlYXQgaW50ZXJ2YWxz IGFuZCBNYXhpbXVtIG1pdGlnYXRpb24gbGlmZXRpbWUNCj4gPiA+Pj4+PiBjb25maWd1cmF0aW9u IGluIERPVFMNCj4gPiA+Pj4+IGRhdGEgY2hhbm5lbCBjYW4gYmUgdHJlYXRlZCBhcyBnbG9iYWwg Y29uZmlndXJhdGlvbiB1c2VkIGZvciBhbGwNCj4gPiA+Pj4+IERPVFMgc2lnbmFsIGNoYW5uZWxz IGIvdyBET1RTIGFnZW50cywgdW5sZXNzIHNwZWNpZmljYWxseQ0KPiA+ID4+Pj4gb3Zlci13cml0 dGVuIGJ5IHRoZSBET1RTIHNpZ25hbCBjaGFubmVsLg0KPiA+ID4+Pj4gU2VlbXMgbGlrZSBtb3Jl IGNvbXBsZXhpdHkgdGhhbiBuZWVkZWQgLSBJJ2QganVzdCBoYXZlIG9uZSBzZXQgb2YNCj4gPiA+ Pj4+IHZhbHVlcyBpbiB0aGUgcHJvdG9jb2wgKHNpZ25hbCBjaGFubmVsKS4NCj4gPiA+Pj4gVGhl IGFkdmFudGFnZSBvZiB0aGUgYWJvdmUgYXBwcm9hY2ggaXM6IHNldHRpbmcgdGhlIHZhbHVlcyBp biBkYXRhDQo+ID4gPj4+IGNoYW5uZWwNCj4gPiA+PiBkdXJpbmcgcGVhY2UgdGltZSBhdm9pZHMg dGhlIG5lZWQgdG8gY29udmV5IHRoZSBjb25maWd1cmF0aW9uDQo+ID4gPj4gcGFyYW1ldGVycyBp biB0aGUgc2lnbmFsIGNoYW5uZWwgZHVyaW5nIEREb1MgYXR0YWNrLg0KPiA+ID4+IFlvdSBoYXZl IHRvIGVzdGFibGlzaCBhIGJpZGlyZWN0aW9uYWwgbXV0dWFsbHkgYXV0aGVudGljYXRlZCBzaWdu YWwNCj4gPiA+PiBjaGFubmVsIHJlZ2FyZGxlc3MsIHNvIGF0IGxlYXN0IG9uZSBtZXNzYWdlIG5l ZWRzIHRvIGdldCB0aHJvdWdoIC0NCj4gPiA+PiB0aGF0IG1lc3NhZ2UgY2FuIHNpbXBseSBzZXQg dGhlIHZhbHVlLg0KPiA+ID4gVGhhdCBvbmUgbWVzc2FnZSBjYW4gY29udmV5IHRoZSBET1RTIHNp Z25hbCwgYW5kIG92ZXItbG9hZGluZyB0aGlzDQo+ID4gPiByZXF1ZXN0DQo+ID4gd2l0aCBhZGRp dGlvbmFsIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyB3aWxsIGluY3JlYXNlIHRoZSBjb21wbGV4 aXR5DQo+ID4gb2YgaGFuZGxpbmcgZXJyb3IgY29uZGl0aW9ucyB3aGVyZSB0aGUgc2VydmVyIG1h eSBhY3Qgb24gdGhlIERPVFMNCj4gPiBzaWduYWwgYnV0IHRoZSBjb25maWd1cmF0aW9uIHBhcmFt ZXRlcnMgbWF5IG5vdCBiZSBhY2NlcHRhYmxlIHRvIHRoZQ0KPiA+IHNlcnZlci4gIFRoZSBuZWdv dGlhdGlvbiBvZiB0aGUgY29uZmlndXJhdGlvbiBtYXkgdGFrZSBtdWx0aXBsZQ0KPiA+IHJlcXVl c3RzL3Jlc3BvbnNlcyBhbmQgbWF5IGludm9sdmUgbXVsdGlwbGUgcmUtdHJhbnNtaXNzaW9ucyBk dXJpbmcgYQ0KPiBERE9TIGF0dGFjay4NCj4gPiA+DQo+ID4gPj4gQXMgZm9yIGhhdmluZyB0aGUg c2FtZSBkYXRhIGNvbnZleWVkIHZpYSBtdWx0aXBsZSBhdmVudWVzLCBpdCBhZGRzDQo+ID4gPj4g YWRkaXRpb25hbCBjb21wbGV4aXR5IGFuZCBsZWFkcyB0byB2YXJpb3VzIGluY29uc2lzdGVuY3kg YW5kIHJhY2UNCj4gPiA+PiBjb25kaXRpb24gaXNzdWVzIHlvdSBoYXZlIHRvIGRlYWwgd2l0aC4g SSdtIG5vdCBpbiBmYXZvciBvZiB0aGF0DQo+ID4gPj4gdW5sZXNzIGl0IGFkZHMgc3Vic3RhbnRp YWwgYmVuZWZpdHMsIGFuZCBJIGhhdmVuJ3Qgc2VlbiB0aG9zZSB5ZXQuDQo+ID4gPiBUaGUgYWR2 YW50YWdlIGlzIERPVFMgZGF0YSBjaGFubmVsIHdpbGwgYW55d2F5IGJlIGNyZWF0ZWQgZHVyaW5n IHRoZQ0KPiA+IHBlYWNldGltZSB0byBjcmVhdGUgYWxpYXMsIGl0IGNhbiBhbHNvIGJlIHVzZWQg dG8gbmVnb3RpYXRlDQo+ID4gY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzIGFuZCBjYW4gYmUgdXNl ZCBmb3IgYWxsIHRoZSBET1RTIHNpZ25hbCBjaGFubmVscy4NCj4gPiA+DQo+ID4gPiBUaGUgbWVz c2FnZSB0cmFuc21pc3Npb24gcGFyYW1ldGVycyBuZWdvdGlhdGVkIGluIERPVFMgZGF0YSBjaGFu bmVsDQo+ID4gZHVyaW5nIHBlYWNlIHRpbWUgY2FuIGJlIHVzZWQgaW5mbHVlbmNlIHRoZSBtYXgg bnVtYmVyIG9mDQo+ID4gcmV0cmFuc21pc3Npb25zLCBtYXggcmV0cmFuc21pc3Npb24gc3BhbiBl dGMuIGZvciBmaXJzdCBET1RTIHNpZ25hbA0KPiBtZXNzYWdlLg0KPiA+ID4NCj4gPiA+IEkgZG9u J3Qgc2VlIGEgbmVlZCB0byByZS1uZWdvdGlhdGUgdGhlIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVy cyBpbg0KPiA+ID4gdGhlIERPVFMNCj4gPiBzaWduYWwgY2hhbm5lbCBkdXJpbmcgYSBERE9TIGF0 dGFjay4NCj4gPiA+DQo+ID4gPj4gVGhhbmtzDQo+ID4gPj4NCj4gPiA+PiAtLSBGbGVtbWluZw0K PiA+ID4gLg0KPiA+ID4NCj4gDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQo+IERvdHMgbWFpbGluZyBsaXN0DQo+IERvdHNAaWV0Zi5vcmcNCj4gaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kb3RzDQo= From nobody Wed Sep 28 20:02:39 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A36912B05A for ; Wed, 28 Sep 2016 20:02:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sVF6G0lSdkBO for ; Wed, 28 Sep 2016 20:02:35 -0700 (PDT) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB63312B058 for ; Wed, 28 Sep 2016 20:02:34 -0700 (PDT) Received: from 172.18.7.190 (EHLO lhreml704-cah.china.huawei.com) ([172.18.7.190]) by lhrrg02-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CSC04004; Thu, 29 Sep 2016 03:02:32 +0000 (GMT) Received: from SZXEMA419-HUB.china.huawei.com (10.82.72.37) by lhreml704-cah.china.huawei.com (10.201.5.130) with Microsoft SMTP Server (TLS) id 14.3.235.1; Thu, 29 Sep 2016 04:02:31 +0100 Received: from SZXEMA502-MBS.china.huawei.com ([169.254.4.86]) by SZXEMA419-HUB.china.huawei.com ([10.82.72.37]) with mapi id 14.03.0235.001; Thu, 29 Sep 2016 11:02:27 +0800 From: "Xialiang (Frank)" To: "Tirumaleswar Reddy (tireddy)" Thread-Topic: [Dots] DOTS Requirements: DATA-003 Session configuration Thread-Index: AQHSF0t58Ph4uHS8s0qhMm1dtY/fhaCK+KyAgACWpICAAKoHAIAAh3qAgAAF9wCAABI6AIAABaGAgAEvfMCAATHUAIAAiyUw Date: Thu, 29 Sep 2016 03:02:26 +0000 Message-ID: References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> <7606d458-6818-9246-b522-d90989ef110d@cisco.com> <4668d5bb12d64854aa8ad75b57f5179d@XCH-RCD-017.cisco.com> In-Reply-To: <4668d5bb12d64854aa8ad75b57f5179d@XCH-RCD-017.cisco.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.135.43.91] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020206.57EC8449.0008, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.4.86, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 174d38ad933c9b338d16424f4727aa4d Archived-At: Cc: "Flemming Andreasen \(fandreas\)" , dots Subject: [Dots] =?gb2312?b?tPC4tDogIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRBLTAw?= =?gb2312?b?MyBTZXNzaW9uIGNvbmZpZ3VyYXRpb24=?= X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2016 03:02:38 -0000 SGkgVGlydSwNCg0KLS0tLS3Tyrz+1K28/i0tLS0tDQq3orz+yMs6IFRpcnVtYWxlc3dhciBSZWRk eSAodGlyZWRkeSkgW21haWx0bzp0aXJlZGR5QGNpc2NvLmNvbV0gDQq3osvNyrG85DogMjAxNsTq OdTCMjnI1SAxMDozNw0KytW8/sjLOiBYaWFsaWFuZyAoRnJhbmspOyBGbGVtbWluZyBBbmRyZWFz ZW4gKGZhbmRyZWFzKTsgZG90cw0K1vfM4jogUkU6IFtEb3RzXSBET1RTIFJlcXVpcmVtZW50czog REFUQS0wMDMgU2Vzc2lvbiBjb25maWd1cmF0aW9uDQoNCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdl LS0tLS0NCj4gRnJvbTogWGlhbGlhbmcgKEZyYW5rKSBbbWFpbHRvOmZyYW5rLnhpYWxpYW5nQGh1 YXdlaS5jb21dDQo+IFNlbnQ6IFdlZG5lc2RheSwgU2VwdGVtYmVyIDI4LCAyMDE2IDY6MDAgQU0N Cj4gVG86IFRpcnVtYWxlc3dhciBSZWRkeSAodGlyZWRkeSkgPHRpcmVkZHlAY2lzY28uY29tPjsg RmxlbW1pbmcgDQo+IEFuZHJlYXNlbg0KPiAoZmFuZHJlYXMpIDxmYW5kcmVhc0BjaXNjby5jb20+ OyBkb3RzIDxkb3RzQGlldGYub3JnPg0KPiBTdWJqZWN0OiC08Li0OiBbRG90c10gRE9UUyBSZXF1 aXJlbWVudHM6IERBVEEtMDAzIFNlc3Npb24gY29uZmlndXJhdGlvbg0KPiANCj4gSGksDQo+IA0K PiAtLS0tLdPKvP7Urbz+LS0tLS0NCj4gt6K8/sjLOiBEb3RzIFttYWlsdG86ZG90cy1ib3VuY2Vz QGlldGYub3JnXSC0+rHtIFRpcnVtYWxlc3dhciBSZWRkeQ0KPiAodGlyZWRkeSkNCj4gt6LLzcqx vOQ6IDIwMTbE6jnUwjI3yNUgMjI6MTYNCj4gytW8/sjLOiBGbGVtbWluZyBBbmRyZWFzZW4gKGZh bmRyZWFzKTsgZG90cw0KPiDW98ziOiBSZTogW0RvdHNdIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRB LTAwMyBTZXNzaW9uIGNvbmZpZ3VyYXRpb24NCj4gDQo+ID4gLS0tLS1PcmlnaW5hbCBNZXNzYWdl LS0tLS0NCj4gPiBGcm9tOiBGbGVtbWluZyBBbmRyZWFzZW4gKGZhbmRyZWFzKQ0KPiA+IFNlbnQ6 IFR1ZXNkYXksIFNlcHRlbWJlciAyNywgMjAxNiA3OjI2IFBNDQo+ID4gVG86IFRpcnVtYWxlc3dh ciBSZWRkeSAodGlyZWRkeSkgPHRpcmVkZHlAY2lzY28uY29tPjsgZG90cyANCj4gPiA8ZG90c0Bp ZXRmLm9yZz4NCj4gPiBTdWJqZWN0OiBSZTogW0RvdHNdIERPVFMgUmVxdWlyZW1lbnRzOiBEQVRB LTAwMyBTZXNzaW9uIA0KPiA+IGNvbmZpZ3VyYXRpb24NCj4gPg0KPiA+IEkgdGhpbmsgd2UgaGF2 ZSBkaWZmZXJlbnQgdmlld3Mgb2YgdGhlIERPVFMgd29ybGQgaGVyZS4gTXkgdmlldyBpcyANCj4g PiB0aGF0IHlvdSBzdGFydCBlc3RhYmxpc2hpbmcgYSBzaWduYWwgY2hhbm5lbCwgYW5kIHlvdSBt YXkgZXN0YWJsaXNoIA0KPiA+IGEgZGF0YSBjaGFubmVsIHRoYXQgb2NjYXNpb25hbGx5IGNhbiBi ZSB1c2VkIHRvIGNvbnZleSB2YXJpb3VzIA0KPiA+IG9wZXJhdGlvbmFsbHkgcmVsYXRlZCBwYXJh bWV0ZXJzLCBzdWNoIGFzIHdoaXRlbGlzdHMsIGJsYWNrbGlzdHMsIGZpbHRlcnMsIGV0Yy4NCj4g DQo+IEluIHZhcmlvdXMgc2NlbmFyaW9zLCBET1RTIGRhdGEgY2hhbm5lbCBpcyBzdXBwb3NlZCB0 byBiZSBlc3RhYmxpc2hlZCANCj4gYmVmb3JlIERPVFMgc2lnbmFsIGNoYW5uZWwsIGZvciBleGFt cGxlIHRvIGNyZWF0ZSBhbGlhcyBmb3IgcmVzb3VyY2VzLg0KPiBbRnJhbmtdOiB0aGUgcG9pbnQg aXMgc29tZSBjb25maWd1cmF0aW9uIHBhcmFtZXRlcnMgaGFkIGJldHRlciBiZSANCj4gZXhjaGFu Z2VkIGR1cmluZyB0aGUgcGVhY2V0aW1lLCB1c3VhbGx5IGJlZm9yZSB0aGUgc2lnbmFsaW5nIGNo YW5uZWwgaXMgZXN0YWJsaXNoZWQuDQo+IFVzaW5nIGRhdGEgY2hhbm5lbCBmb3IgdGhpcyBmdW5j dGlvbiBpcyByZWFzb25hYmxlIGFuZCBsb2dpY2FsbHkgY2xlYXIgZm9yIG1lLg0KPiANCj4gPiBU aGUgc2lnbmFsIGNoYW5uZWwgc2hvdWxkIHNwZWNpZnkgaG93IHRoZSBzaWduYWwgY2hhbm5lbCB3 b3JrcyBhcyANCj4gPiBwYXJ0IG9mIHRoZSBzaWduYWwgY2hhbm5lbCBlc3RhYmxpc2htZW50OyB0 aGF0IGluY2x1ZGVzIA0KPiA+IGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycywgZXh0ZW5zaW9ucyBz dXBwb3J0ZWQsIGV0Yy4NCj4gPg0KPiA+IE5vIERPVFMgc2lnbmFsIGNoYW5uZWwgPT4gbm8gRE9U UyBvcGVyYXRpb24uDQo+ID4gTm8gRE9UUyBkYXRhIGNoYW5uZWwgZG9lcyBub3QgbmVjZXNzYXJp bHkgaW1wbHkgdGhlIHNhbWUuDQo+ID4NCj4gPiBBcyB0byBhcmd1bWVudHMgYXJvdW5kIHRoZSBk YXRhIGNoYW5uZWwgYmVpbmcgdGhlIGJldHRlciBwbGFjZSB0byANCj4gPiBuZWdvdGlhdGUgdGhp bmdzIGJlY2F1c2UgaXQncyB1c2VkIGR1cmluZyBwZWFjZS10aW1lLCBpdCdzIGEgcmVkIA0KPiA+ IGhlcnJpbmcgYmVjYXVzZSB0aGUgc2lnbmFsIGNoYW5uZWwgd2lsbCBvYnZpb3VzbHkgd29yayBq dXN0IGFzIHdlbGwgDQo+ID4gaW4gcGVhY2UtdGltZS4gTm93LCBJIGFncmVlLCB3ZSBzaG91bGQn bid0IHJlbmVnb3RpYXRlIHRoZSANCj4gPiBwYXJhbWV0ZXJzIGluIHF1ZXN0aW9uIGR1cmluZyBh biBhdHRhY2ssIGJ1dCBhZ2FpbiwgaXQncyBvcnRob2dvbmFsIA0KPiA+IHRvIHdoZXRoZXIgdGhh dCBpcyBkb25lIGluIHRoZSBzaWduYWwgb3IgZGF0YSBjaGFubmVsIC0gaWYgYW55dGhpbmcsIA0K PiA+IHRoZSBkYXRhIGNoYW5uZWwgd291bGQgaGF2ZSBhIG11Y2ggbG93ZXIgY2hhbmNlIG9mIHdv cmtpbmcgZHVyaW5nIGFuIGFjdGl2ZSBERG9TIGF0dGFjay4NCj4gDQo+IFllcywgRE9UUyBkYXRh IGNoYW5uZWwgaXMgZXhwZWN0ZWQgdG8gYmUgdXNlZCBvbmx5IGR1cmluZyBwZWFjZXRpbWUuDQo+ IElmIHdlIGFncmVlIHRoYXQgY29uZmlndXJhdGlvbiBwYXJhbWV0ZXJzIHNob3VsZCBiZSBuZWdv dGlhdGVkIGR1cmluZyANCj4gcGVhY2V0aW1lIHRoZW4gdXNpbmcgRE9UUyBzaWduYWwgY2hhbm5l bCB0byBuZWdvdGlhdGUgdGhlbSB3b3JrcyBmb3IgbWUuDQo+IFtGcmFua106IGRpc2FncmVlLCBp dCBpcyBub3QgbmVjZXNzYXJ5IGFuZCB3aWxsIGluZmx1ZW5jZSB0aGUgZXhpc3RpbmcgDQo+IERP VFMgYXJjaGl0ZWN0dXJlLg0KDQpET1RTIGRhdGEgY2hhbm5lbCB3aWxsIHN0aWxsIGJlIHVzZWQg Zm9yIG90aGVyIGNvbmZpZ3VyYXRpb24gbGlrZSBmaWx0ZXJzLCBhbGlhcyBldGMuIFRoZSByZWFz b24gZm9yIG1vdmluZyB0aGVzZSBjb25maWd1cmF0aW9uIHBhcmFtZXRlcnMgYXJlIHRoYXQgdGhl IERPVFMgc2lnbmFsIGNoYW5uZWwgbWF5IHdhbnQgdG8gbGF0ZXIgdXBkYXRlIGl0IGJhc2VkIG9u IHRoZSBuZXR3b3JrIGNvbmRpdGlvbnMgYW5kIGl0J3MgYmV0dGVyIHRvIG5lZ290aWF0ZSB0aGVt IGluIG9uZSBjaGFubmVsIGFuZCBub3QgbXVsdGlwbGUgY2hhbm5lbHMuIA0KW0ZyYW5rXTogRE9U UyBzaWduYWxpbmcgY2hhbm5lbCBoYWQgYmV0dGVyIGJlIHVzZWQgdG8gc2VuZCBtZXNzYWdlcyBv ZiBjYWxsIGZvciBoZWxwLCBzdGF0dXMgdXBkYXRlLCBlc3NlbnRpYWwgdGVsZW1ldHJ5LiBTZW5k aW5nIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBvZiBzaWduYWxpbmcgY2hhbm5lbCBieSBpdHNl bGYgc2VlbXMgYSBsaXR0bGUgYml0IHRyaWNreSwgSU1ITy4NCg0KQi5SLg0KRnJhbmsNCg0KV2h5 IGRvIHlvdSB0aGluayBpdCBpcyBub3QgbmVjZXNzYXJ5IGFuZCB3aWxsIGltcGFjdCB0aGUgRE9U UyBhcmNoaXRlY3R1cmUgYWR2ZXJzZWx5ID8NCg0KLVRpcnUNCg0KPiANCj4gQi5SLg0KPiBGcmFu aw0KPiANCj4gLVRpcnUNCj4gDQo+ID4NCj4gPiBUaGFua3MNCj4gPg0KPiA+IC0tIEZsZW1taW5n DQo+ID4NCj4gPg0KPiA+IE9uIDkvMjcvMTYgODo1MCBBTSwgVGlydW1hbGVzd2FyIFJlZGR5ICh0 aXJlZGR5KSB3cm90ZToNCj4gPiA+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiA+ID4+ IEZyb206IEZsZW1taW5nIEFuZHJlYXNlbiAoZmFuZHJlYXMpDQo+ID4gPj4gU2VudDogVHVlc2Rh eSwgU2VwdGVtYmVyIDI3LCAyMDE2IDU6NTkgUE0NCj4gPiA+PiBUbzogVGlydW1hbGVzd2FyIFJl ZGR5ICh0aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb20+OyBkb3RzIA0KPiA+ID4+IDxkb3RzQGll dGYub3JnPg0KPiA+ID4+IFN1YmplY3Q6IFJlOiBbRG90c10gRE9UUyBSZXF1aXJlbWVudHM6IERB VEEtMDAzIFNlc3Npb24gDQo+ID4gPj4gY29uZmlndXJhdGlvbg0KPiA+ID4+DQo+ID4gPj4NCj4g PiA+Pg0KPiA+ID4+IE9uIDkvMjcvMTYgMTI6MjQgQU0sIFRpcnVtYWxlc3dhciBSZWRkeSAodGly ZWRkeSkgd3JvdGU6DQo+ID4gPj4+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiA+ID4+ Pj4gRnJvbTogRmxlbW1pbmcgQW5kcmVhc2VuIChmYW5kcmVhcykNCj4gPiA+Pj4+IFNlbnQ6IE1v bmRheSwgU2VwdGVtYmVyIDI2LCAyMDE2IDExOjQ2IFBNDQo+ID4gPj4+PiBUbzogVGlydW1hbGVz d2FyIFJlZGR5ICh0aXJlZGR5KSA8dGlyZWRkeUBjaXNjby5jb20+OyBkb3RzIA0KPiA+ID4+Pj4g PGRvdHNAaWV0Zi5vcmc+DQo+ID4gPj4+PiBTdWJqZWN0OiBSZTogW0RvdHNdIERPVFMgUmVxdWly ZW1lbnRzOiBEQVRBLTAwMyBTZXNzaW9uIA0KPiA+ID4+Pj4gY29uZmlndXJhdGlvbg0KPiA+ID4+ Pj4NCj4gPiA+Pj4+DQo+ID4gPj4+Pg0KPiA+ID4+Pj4gT24gOS8yNi8xNiA1OjE2IEFNLCBUaXJ1 bWFsZXN3YXIgUmVkZHkgKHRpcmVkZHkpIHdyb3RlOg0KPiA+ID4+Pj4+PiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPiA+ID4+Pj4+PiBGcm9tOiBEb3RzIFttYWlsdG86ZG90cy1ib3VuY2Vz QGlldGYub3JnXSBPbiBCZWhhbGYgT2YgDQo+ID4gPj4+Pj4+IEZsZW1taW5nIEFuZHJlYXNlbg0K PiA+ID4+Pj4+PiAoZmFuZHJlYXMpDQo+ID4gPj4+Pj4+IFNlbnQ6IFN1bmRheSwgU2VwdGVtYmVy IDI1LCAyMDE2IDEwOjEwIFBNDQo+ID4gPj4+Pj4+IFRvOiBkb3RzIDxkb3RzQGlldGYub3JnPg0K PiA+ID4+Pj4+PiBTdWJqZWN0OiBbRG90c10gRE9UUyBSZXF1aXJlbWVudHM6IERBVEEtMDAzIFNl c3Npb24gDQo+ID4gPj4+Pj4+IGNvbmZpZ3VyYXRpb24NCj4gPiA+Pj4+Pj4NCj4gPiA+Pj4+Pj4g UmVxdWlyZW1lbnQgREFUQS0wMDMgKFNlc3Npb24gY29uZmlndXJhdGlvbiksIHdoaWNoIGRlYWxz IA0KPiA+ID4+Pj4+PiB3aXRoIHRoZSBkYXRhIGNoYW5uZWwgcmVxdWlyZW1lbnQsIGluY2x1ZGUg dGhlICBmb2xsb3dpbmc6DQo+ID4gPj4+Pj4+IDxxdW90ZT4NCj4gPiA+Pj4+Pj4gRE9UUyBzZXJ2 ZXINCj4gPiA+Pj4+Pj4gICAgICAgICAgIGltcGxlbWVudGF0aW9ucyBNVVNUIGhhdmUgbWVjaGFu aXNtcyB0byBjb25maWd1cmUgDQo+ID4gPj4+Pj4+IHRoZQ0KPiA+ID4+IGZvbGxvd2luZzoNCj4g PiA+Pj4+Pj4gICAgICAgICAgICogIEFjY2VwdGFibGUgc2lnbmFsIGxvc3NpbmVzcywgYXMgZGVz Y3JpYmVkIGluIEdFTi0wMDIuDQo+ID4gPj4+Pj4+DQo+ID4gPj4+Pj4+ICAgICAgICAgICAqICBI ZWFydGJlYXQgaW50ZXJ2YWxzLCBhcyBkZXNjcmliZWQgaW4gT1AtMDAyLg0KPiA+ID4+Pj4+Pg0K PiA+ID4+Pj4+PiAgICAgICAgICAgKiAgTWF4aW11bSBtaXRpZ2F0aW9uIGxpZmV0aW1lLCBhcyBk ZXNjcmliZWQgaW4gT1AtMDA1Lg0KPiA+ID4+Pj4+Pg0KPiA+ID4+Pj4+PiAgICAgICAgICAgKiAg UmVzb3VyY2UgaWRlbnRpZmllcnMsIGFzIGRlc2NyaWJlZCBpbiBPUC0wMDYuDQo+ID4gPj4+Pj4+ IDwvcXVvdGU+DQo+ID4gPj4+Pj4+DQo+ID4gPj4+Pj4+IFJlc291cmNlIGlkZW50aWZpZXIgY29u ZmlnIG1ha2VzIHNlbnNlIHRvIG1lLCBidXQgd2h5IGFyZW4ndCANCj4gPiA+Pj4+Pj4gdGhlIGZp cnN0IDMgc2ltcGx5IHBhcnQgb2YgdGhlIHNpZ25hbCBjaGFubmVsIGVzdGFibGlzaG1lbnQgDQo+ ID4gPj4+Pj4+IHByb2NlZHVyZSAod2hpY2ggd291bGQgaGF2ZSB0aGUgYWRkZWQgYmVuZWZpdCBv ZiBhbGxvd2luZyANCj4gPiA+Pj4+Pj4gdGhlbSB0byBiZSBhZGp1c3RlZCBtb3JlIGVhc2lseSBs YXRlcg0KPiA+ID4+Pj4+PiBvbikgPw0KPiA+ID4+Pj4+IEFjY2VwdGFibGUgc2lnbmFsIGxvc3Np bmVzcyBjb25maWd1cmF0aW9uIGhlbHBzIGRldGVybWluZSB0aGUgDQo+ID4gPj4+Pj4gbG9zc2lu ZXNzDQo+ID4gPj4+PiBwYXJhbWV0ZXJzIChlLmcuIG1heCBudW1iZXIgb2YgcmUtdHJhbnNtaXNz aW9ucywgbWF4IA0KPiA+ID4+Pj4gcmUtdHJhbnNtaXNzaW9uIHBhcmFtZXRlcnMgZXRjLikgZm9y IHRoZSBmaXJzdCBET1RTIHNpZ25hbCBtZXNzYWdlLg0KPiA+ID4+Pj4gVGhlIGZpcnN0IERPVFMg c2lnbmFsIG1lc3NhZ2UgbWF5IGNvbnZleSBuZXcgc2lnbmFsIGxvc3NpbmVzcyANCj4gPiA+Pj4+ IGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBmb3Igc3Vic2VxdWVudCBET1RTIHNpZ25hbCBtZXNz YWdlcy4NCj4gPiA+Pj4+PiBIZWFydGJlYXQgaW50ZXJ2YWxzIGFuZCBNYXhpbXVtIG1pdGlnYXRp b24gbGlmZXRpbWUgDQo+ID4gPj4+Pj4gY29uZmlndXJhdGlvbiBpbiBET1RTDQo+ID4gPj4+PiBk YXRhIGNoYW5uZWwgY2FuIGJlIHRyZWF0ZWQgYXMgZ2xvYmFsIGNvbmZpZ3VyYXRpb24gdXNlZCBm b3IgDQo+ID4gPj4+PiBhbGwgRE9UUyBzaWduYWwgY2hhbm5lbHMgYi93IERPVFMgYWdlbnRzLCB1 bmxlc3Mgc3BlY2lmaWNhbGx5IA0KPiA+ID4+Pj4gb3Zlci13cml0dGVuIGJ5IHRoZSBET1RTIHNp Z25hbCBjaGFubmVsLg0KPiA+ID4+Pj4gU2VlbXMgbGlrZSBtb3JlIGNvbXBsZXhpdHkgdGhhbiBu ZWVkZWQgLSBJJ2QganVzdCBoYXZlIG9uZSBzZXQgDQo+ID4gPj4+PiBvZiB2YWx1ZXMgaW4gdGhl IHByb3RvY29sIChzaWduYWwgY2hhbm5lbCkuDQo+ID4gPj4+IFRoZSBhZHZhbnRhZ2Ugb2YgdGhl IGFib3ZlIGFwcHJvYWNoIGlzOiBzZXR0aW5nIHRoZSB2YWx1ZXMgaW4gDQo+ID4gPj4+IGRhdGEg Y2hhbm5lbA0KPiA+ID4+IGR1cmluZyBwZWFjZSB0aW1lIGF2b2lkcyB0aGUgbmVlZCB0byBjb252 ZXkgdGhlIGNvbmZpZ3VyYXRpb24gDQo+ID4gPj4gcGFyYW1ldGVycyBpbiB0aGUgc2lnbmFsIGNo YW5uZWwgZHVyaW5nIEREb1MgYXR0YWNrLg0KPiA+ID4+IFlvdSBoYXZlIHRvIGVzdGFibGlzaCBh IGJpZGlyZWN0aW9uYWwgbXV0dWFsbHkgYXV0aGVudGljYXRlZCANCj4gPiA+PiBzaWduYWwgY2hh bm5lbCByZWdhcmRsZXNzLCBzbyBhdCBsZWFzdCBvbmUgbWVzc2FnZSBuZWVkcyB0byBnZXQgDQo+ ID4gPj4gdGhyb3VnaCAtIHRoYXQgbWVzc2FnZSBjYW4gc2ltcGx5IHNldCB0aGUgdmFsdWUuDQo+ ID4gPiBUaGF0IG9uZSBtZXNzYWdlIGNhbiBjb252ZXkgdGhlIERPVFMgc2lnbmFsLCBhbmQgb3Zl ci1sb2FkaW5nIHRoaXMgDQo+ID4gPiByZXF1ZXN0DQo+ID4gd2l0aCBhZGRpdGlvbmFsIGNvbmZp Z3VyYXRpb24gcGFyYW1ldGVycyB3aWxsIGluY3JlYXNlIHRoZSANCj4gPiBjb21wbGV4aXR5IG9m IGhhbmRsaW5nIGVycm9yIGNvbmRpdGlvbnMgd2hlcmUgdGhlIHNlcnZlciBtYXkgYWN0IG9uIA0K PiA+IHRoZSBET1RTIHNpZ25hbCBidXQgdGhlIGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBtYXkg bm90IGJlIA0KPiA+IGFjY2VwdGFibGUgdG8gdGhlIHNlcnZlci4gIFRoZSBuZWdvdGlhdGlvbiBv ZiB0aGUgY29uZmlndXJhdGlvbiBtYXkgDQo+ID4gdGFrZSBtdWx0aXBsZSByZXF1ZXN0cy9yZXNw b25zZXMgYW5kIG1heSBpbnZvbHZlIG11bHRpcGxlIA0KPiA+IHJlLXRyYW5zbWlzc2lvbnMgZHVy aW5nIGENCj4gRERPUyBhdHRhY2suDQo+ID4gPg0KPiA+ID4+IEFzIGZvciBoYXZpbmcgdGhlIHNh bWUgZGF0YSBjb252ZXllZCB2aWEgbXVsdGlwbGUgYXZlbnVlcywgaXQgDQo+ID4gPj4gYWRkcyBh ZGRpdGlvbmFsIGNvbXBsZXhpdHkgYW5kIGxlYWRzIHRvIHZhcmlvdXMgaW5jb25zaXN0ZW5jeSBh bmQgDQo+ID4gPj4gcmFjZSBjb25kaXRpb24gaXNzdWVzIHlvdSBoYXZlIHRvIGRlYWwgd2l0aC4g SSdtIG5vdCBpbiBmYXZvciBvZiANCj4gPiA+PiB0aGF0IHVubGVzcyBpdCBhZGRzIHN1YnN0YW50 aWFsIGJlbmVmaXRzLCBhbmQgSSBoYXZlbid0IHNlZW4gdGhvc2UgeWV0Lg0KPiA+ID4gVGhlIGFk dmFudGFnZSBpcyBET1RTIGRhdGEgY2hhbm5lbCB3aWxsIGFueXdheSBiZSBjcmVhdGVkIGR1cmlu ZyANCj4gPiA+IHRoZQ0KPiA+IHBlYWNldGltZSB0byBjcmVhdGUgYWxpYXMsIGl0IGNhbiBhbHNv IGJlIHVzZWQgdG8gbmVnb3RpYXRlIA0KPiA+IGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVycyBhbmQg Y2FuIGJlIHVzZWQgZm9yIGFsbCB0aGUgRE9UUyBzaWduYWwgY2hhbm5lbHMuDQo+ID4gPg0KPiA+ ID4gVGhlIG1lc3NhZ2UgdHJhbnNtaXNzaW9uIHBhcmFtZXRlcnMgbmVnb3RpYXRlZCBpbiBET1RT IGRhdGEgDQo+ID4gPiBjaGFubmVsDQo+ID4gZHVyaW5nIHBlYWNlIHRpbWUgY2FuIGJlIHVzZWQg aW5mbHVlbmNlIHRoZSBtYXggbnVtYmVyIG9mIA0KPiA+IHJldHJhbnNtaXNzaW9ucywgbWF4IHJl dHJhbnNtaXNzaW9uIHNwYW4gZXRjLiBmb3IgZmlyc3QgRE9UUyBzaWduYWwNCj4gbWVzc2FnZS4N Cj4gPiA+DQo+ID4gPiBJIGRvbid0IHNlZSBhIG5lZWQgdG8gcmUtbmVnb3RpYXRlIHRoZSBjb25m aWd1cmF0aW9uIHBhcmFtZXRlcnMgaW4gDQo+ID4gPiB0aGUgRE9UUw0KPiA+IHNpZ25hbCBjaGFu bmVsIGR1cmluZyBhIERET1MgYXR0YWNrLg0KPiA+ID4NCj4gPiA+PiBUaGFua3MNCj4gPiA+Pg0K PiA+ID4+IC0tIEZsZW1taW5nDQo+ID4gPiAuDQo+ID4gPg0KPiANCj4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gRG90cyBtYWlsaW5nIGxpc3QNCj4g RG90c0BpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Rv dHMNCg== From nobody Wed Sep 28 21:42:12 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7D3812B05E for ; Wed, 28 Sep 2016 21:42:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VH4m1K0oDyd3 for ; Wed, 28 Sep 2016 21:42:08 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC77112B016 for ; Wed, 28 Sep 2016 21:42:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3552; q=dns/txt; s=iport; t=1475124127; x=1476333727; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=PJqgGxqKbpiteMqfTBtAdBCrEAQUgMv5jPIB5UL0Mns=; b=j/eLX3l9dmCMWHT7fXbMJQJQoeQ5xnyeP1al2J6odaTSB9AYE3vS7RUU 14OkmLuTuUdKJdVxtkFv4VskO/fjb+MpxJN7LWbuo/3HG1UK+3dHcl2Q8 PbT90gpLb5dlYc8jmWAMYq0AY6+dg42WkB3C3T8dwjLk7jg2mNgxVrJhd I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B6AQBAmuxX/51dJa1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgz8BAQEBAR5XfAeNK6seggYmhXgCHIFDOBQBAgEBAQEBAQFeHAuEYQE?= =?us-ascii?q?BAQQjEUMOBAIBCBEEAQEDAiMDAgICMBQBBgEBBQMCBBMIiEUOrmWMdQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBARyBBoUxhFSEIQ2DGoJaBY41i0IBhiaJQoF1ToQXiRq?= =?us-ascii?q?MbYN8AR42hQlyAYVNgS6BAAEBAQ?= X-IronPort-AV: E=Sophos;i="5.30,413,1470700800"; d="scan'208";a="154228158" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Sep 2016 04:42:06 +0000 Received: from XCH-ALN-020.cisco.com (xch-aln-020.cisco.com [173.36.7.30]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id u8T4g62p003532 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Thu, 29 Sep 2016 04:42:06 GMT Received: from xch-rcd-017.cisco.com (173.37.102.27) by XCH-ALN-020.cisco.com (173.36.7.30) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 28 Sep 2016 23:42:06 -0500 Received: from xch-rcd-017.cisco.com ([173.37.102.27]) by XCH-RCD-017.cisco.com ([173.37.102.27]) with mapi id 15.00.1210.000; Wed, 28 Sep 2016 23:42:05 -0500 From: "Tirumaleswar Reddy (tireddy)" To: "dots@ietf.org" Thread-Topic: New Version Notification for draft-reddy-dots-signal-channel-01.txt Thread-Index: AQHSGgLCTD6xOdnZG0u0E3GOi8ESRKCP4ihQ Date: Thu, 29 Sep 2016 04:42:05 +0000 Message-ID: <14ddc2a0daba4cf19a01cc0395446df9@XCH-RCD-017.cisco.com> References: <147512022823.16581.17349849150919844363.idtracker@ietfa.amsl.com> In-Reply-To: <147512022823.16581.17349849150919844363.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.65.87.94] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Dots] FW: New Version Notification for draft-reddy-dots-signal-channel-01.txt X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2016 04:42:11 -0000 TWFpbiBjaGFuZ2VzIHRvIHRoZSBkcmFmdCBhbmQgUE9DIGRldGFpbHM6DQoNClsxXSBBZGRlZCBk ZXRhaWxzIG9uIERUTFMgb3ZlcmhlYWQgYW5kIGFkZHJlc3NlZCBvdGhlciBjb21tZW50cyByZWNl aXZlZCBkdXJpbmcgdGhlIGludGVyaW0gbWVldGluZy4NClsyXSBGaXhlZCBtZXNzYWdlIGZvcm1h dCBiYXNlZCBvbiBvdXIgUE9DIGNvZGUgdGVzdGluZy4NClszXSBVc2VkIGNhbGlmb3JuaXVtIGZy YW1ld29yayAoaHR0cHM6Ly9lY2xpcHNlLm9yZy9jYWxpZm9ybml1bS8pIHRvIHNlbmQgYW5kIHJl Y2VpdmUgc29tZSBvZiB0aGUgRE9UUyBtZXNzYWdlcyBvdmVyIERUTFMsIGFuZCBhbHNvIHVzZWQg TW96aWxsYSAod2l0aCBjb3BwZXIgcGx1Z2luIGh0dHBzOi8vYWRkb25zLm1vemlsbGEub3JnL2Vu LVVTL2ZpcmVmb3gvYWRkb24vY29wcGVyLTI3MDQzMC8pIHRvIHNlbmQgRE9UUyBzaWduYWwgbWVz c2FnZSB0byBhIHRlc3QgRE9UUyBzZXJ2ZXIuDQpbNF0gV2UgY291bGQgY2hhbmdlIHRoZSB2YWx1 ZXMgb2YgbWVzc2FnZSB0cmFuc21pc3Npb24gcGFyYW1ldGVycyBkaXNjdXNzZWQgaW4gaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzcyNTIjc2VjdGlvbi00LjggZHluYW1pY2FsbHkuDQoN CkNvbW1lbnRzIGFuZCBzdWdnZXN0aW9ucyBvbiB0aGUgZHJhZnQgYXJlIHdlbGNvbWUuDQoNCi1U aXJ1DQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBpbnRlcm5ldC1kcmFmdHNA aWV0Zi5vcmcgW21haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmddIA0KU2VudDogVGh1cnNk YXksIFNlcHRlbWJlciAyOSwgMjAxNiA5OjA3IEFNDQpUbzogUHJhc2hhbnRoIFBhdGlsIChwcmFz cGF0aSkgPHByYXNwYXRpQGNpc2NvLmNvbT47IE1vaGFtZWQgQm91Y2FkYWlyIDxtb2hhbWVkLmJv dWNhZGFpckBvcmFuZ2UuY29tPjsgVGlydW1hbGVzd2FyIFJlZGR5ICh0aXJlZGR5KSA8dGlyZWRk eUBjaXNjby5jb20+OyBEYW4gV2luZyAoZHdpbmcpIDxkd2luZ0BjaXNjby5jb20+DQpTdWJqZWN0 OiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LXJlZGR5LWRvdHMtc2lnbmFsLWNo YW5uZWwtMDEudHh0DQoNCg0KQSBuZXcgdmVyc2lvbiBvZiBJLUQsIGRyYWZ0LXJlZGR5LWRvdHMt c2lnbmFsLWNoYW5uZWwtMDEudHh0DQpoYXMgYmVlbiBzdWNjZXNzZnVsbHkgc3VibWl0dGVkIGJ5 IFRpcnVtYWxlc3dhciBSZWRkeSBhbmQgcG9zdGVkIHRvIHRoZSBJRVRGIHJlcG9zaXRvcnkuDQoN Ck5hbWU6CQlkcmFmdC1yZWRkeS1kb3RzLXNpZ25hbC1jaGFubmVsDQpSZXZpc2lvbjoJMDENClRp dGxlOgkJRGlzdHJpYnV0ZWQgRGVuaWFsLW9mLVNlcnZpY2UgT3BlbiBUaHJlYXQgU2lnbmFsaW5n IChET1RTKSBTaWduYWwgQ2hhbm5lbA0KRG9jdW1lbnQgZGF0ZToJMjAxNi0wOS0yOA0KR3JvdXA6 CQlJbmRpdmlkdWFsIFN1Ym1pc3Npb24NClBhZ2VzOgkJMjQNClVSTDogICAgICAgICAgICBodHRw czovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtcmVkZHktZG90cy1zaWduYWwt Y2hhbm5lbC0wMS50eHQNClN0YXR1czogICAgICAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnL2RvYy9kcmFmdC1yZWRkeS1kb3RzLXNpZ25hbC1jaGFubmVsLw0KSHRtbGl6ZWQ6ICAgICAg IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1yZWRkeS1kb3RzLXNpZ25hbC1jaGFu bmVsLTAxDQpEaWZmOiAgICAgICAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvcmZjZGlmZj91cmwy PWRyYWZ0LXJlZGR5LWRvdHMtc2lnbmFsLWNoYW5uZWwtMDENCg0KQWJzdHJhY3Q6DQogICBUaGlz IGRvY3VtZW50IHNwZWNpZmllcyBhIG1lY2hhbmlzbSB0aGF0IGEgRE9UUyBjbGllbnQgY2FuIHVz ZSB0bw0KICAgc2lnbmFsIHRoYXQgYSBuZXR3b3JrIGlzIHVuZGVyIGEgRGlzdHJpYnV0ZWQgRGVu aWFsLW9mLVNlcnZpY2UgKEREb1MpDQogICBhdHRhY2sgdG8gYW4gdXBzdHJlYW0gRE9UUyBzZXJ2 ZXIgc28gdGhhdCBhcHByb3ByaWF0ZSBtaXRpZ2F0aW9uDQogICBhY3Rpb25zIGFyZSB1bmRlcnRh a2VuIChpbmNsdWRpbmcsIGJsYWNraG9sZSwgZHJvcCwgcmF0ZS1saW1pdCwgb3INCiAgIGFkZCB0 byB3YXRjaCBsaXN0KSBvbiB0aGUgc3VzcGVjdCB0cmFmZmljLiAgVGhlIGRvY3VtZW50IHNwZWNp Zmllcw0KICAgdGhlIERPVFMgc2lnbmFsIGNoYW5uZWwgaW5jbHVkaW5nIEhhcHB5IEV5ZWJhbGxz IGNvbnNpZGVyYXRpb25zLiAgVGhlDQogICBzcGVjaWZpY2F0aW9uIG9mIHRoZSBET1RTIGRhdGEg Y2hhbm5lbCBpcyBlbGFib3JhdGVkIGluIGEgY29tcGFuaW9uDQogICBkb2N1bWVudC4NCg0KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIA0KDQoNClBsZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2Ug YSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Npb24gdW50aWwgdGhl IGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9y Zy4NCg0KVGhlIElFVEYgU2VjcmV0YXJpYXQNCg0K From nobody Thu Sep 29 07:36:48 2016 Return-Path: X-Original-To: dots@ietfa.amsl.com Delivered-To: dots@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEBDC12B446 for ; Thu, 29 Sep 2016 07:36:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.837 X-Spam-Level: X-Spam-Status: No, score=-16.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqU1SSIoX9NM for ; Thu, 29 Sep 2016 07:36:44 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3EB212B578 for ; Thu, 29 Sep 2016 07:36:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3986; q=dns/txt; s=iport; t=1475159798; x=1476369398; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=oK30lLrII33Dz8HGY9g7MZ0QvpMQxuJTA24z3b76has=; b=ZAQF6PuQjLQMEEIvHqACPPv6mhFFdKqvbcdeetiI4BybKEJ9R1nYthCc HejmhpHO7BMtoqpCB7pvtyrRwAoV4W8sZhENSHbN0rKHoAU1Rmtwb36hp j10mVpW/3DqWbbBsMmLcC+P1ePQh8Hjr3PV/0c7fD11GZyWZ8PNideD+Y s=; X-IronPort-AV: E=Sophos;i="5.30,415,1470700800"; d="scan'208";a="152585398" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Sep 2016 14:36:38 +0000 Received: from [10.98.149.195] (bxb-fandreas-8812.cisco.com [10.98.149.195]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id u8TEabox032008; Thu, 29 Sep 2016 14:36:37 GMT To: "Xialiang (Frank)" , "Tirumaleswar Reddy (tireddy)" References: <486ca83f27a943689d7f8d833ac63f24@XCH-RCD-017.cisco.com> <8d669e84-fe7a-5d0d-32b6-04d5316aebf0@cisco.com> <28951ef91826496a824d773b37773885@XCH-RCD-017.cisco.com> <7606d458-6818-9246-b522-d90989ef110d@cisco.com> <4668d5bb12d64854aa8ad75b57f5179d@XCH-RCD-017.cisco.com> From: Flemming Andreasen Message-ID: <627782b5-5223-5faf-aeb4-d103841647a1@cisco.com> Date: Thu, 29 Sep 2016 10:36:37 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=gbk; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: dots Subject: Re: [Dots] =?utf-8?b?562U5aSNOiBET1RTIFJlcXVpcmVtZW50czogREFUQS0wMDMg?= =?utf-8?q?Session_configuration?= X-BeenThere: dots@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2016 14:36:47 -0000 On 9/28/16 11:02 PM, Xialiang (Frank) wrote: > Hi Tiru, > > -----邮件原件----- > 发件人: Tirumaleswar Reddy (tireddy) [mailto:tireddy@cisco.com] > 发送时间: 2016年9月29日 10:37 > 收件人: Xialiang (Frank); Flemming Andreasen (fandreas); dots > 主题: RE: [Dots] DOTS Requirements: DATA-003 Session configuration > >> -----Original Message----- >> From: Xialiang (Frank) [mailto:frank.xialiang@huawei.com] >> Sent: Wednesday, September 28, 2016 6:00 AM >> To: Tirumaleswar Reddy (tireddy) ; Flemming >> Andreasen >> (fandreas) ; dots >> Subject: 答复: [Dots] DOTS Requirements: DATA-003 Session configuration >> >> Hi, >> >> -----邮件原件----- >> 发件人: Dots [mailto:dots-bounces@ietf.org] 代表 Tirumaleswar Reddy >> (tireddy) >> 发送时间: 2016年9月27日 22:16 >> 收件人: Flemming Andreasen (fandreas); dots >> 主题: Re: [Dots] DOTS Requirements: DATA-003 Session configuration >> >>> -----Original Message----- >>> From: Flemming Andreasen (fandreas) >>> Sent: Tuesday, September 27, 2016 7:26 PM >>> To: Tirumaleswar Reddy (tireddy) ; dots >>> >>> Subject: Re: [Dots] DOTS Requirements: DATA-003 Session >>> configuration >>> >>> I think we have different views of the DOTS world here. My view is >>> that you start establishing a signal channel, and you may establish >>> a data channel that occasionally can be used to convey various >>> operationally related parameters, such as whitelists, blacklists, filters, etc. >> In various scenarios, DOTS data channel is supposed to be established >> before DOTS signal channel, for example to create alias for resources. >> [Frank]: the point is some configuration parameters had better be >> exchanged during the peacetime, usually before the signaling channel is established. >> Using data channel for this function is reasonable and logically clear for me. >> >>> The signal channel should specify how the signal channel works as >>> part of the signal channel establishment; that includes >>> configuration parameters, extensions supported, etc. >>> >>> No DOTS signal channel => no DOTS operation. >>> No DOTS data channel does not necessarily imply the same. >>> >>> As to arguments around the data channel being the better place to >>> negotiate things because it's used during peace-time, it's a red >>> herring because the signal channel will obviously work just as well >>> in peace-time. Now, I agree, we should'n't renegotiate the >>> parameters in question during an attack, but again, it's orthogonal >>> to whether that is done in the signal or data channel - if anything, >>> the data channel would have a much lower chance of working during an active DDoS attack. >> Yes, DOTS data channel is expected to be used only during peacetime. >> If we agree that configuration parameters should be negotiated during >> peacetime then using DOTS signal channel to negotiate them works for me. >> [Frank]: disagree, it is not necessary and will influence the existing >> DOTS architecture. > DOTS data channel will still be used for other configuration like filters, alias etc. The reason for moving these configuration parameters are that the DOTS signal channel may want to later update it based on the network conditions and it's better to negotiate them in one channel and not multiple channels. > [Frank]: DOTS signaling channel had better be used to send messages of call for help, status update, essential telemetry. Sending configuration parameters of signaling channel by itself seems a little bit tricky, IMHO. Can you elaborate on what makes it tricky ? My view is that spreading these parameters over two different channels (signal and data) is more tricky than simply conveying them as part of the signal channel itself (different contexts, no fate sharing, etc. which are all handled trivially when using a single channel). Thanks -- Flemming