Subject: [Dots] homenet use case questions

From: "Mortensen, Andrew" <[email-masked]>
Date: Tue, 18 Jul 2017 20:18:35 +0000

Today’s design team meeting focused on the use case document, and particularly the replacement of the homenet use case with a broadband access network use case. Based on the discussion, I’m apparently the unwitting proximate motivator for that change. Because my off-list questions seem to have informed the revision, I thought the most appropriate thing to do under the circumstances would be to bring those same questions to the list for discussion.

The specific questions I asked of one of use case editors were as follows:

* Are DDoS attacks against individual SOHO networks actually that common?

* Are ISPs going to add attack detection capabilities to SOHO CPEs? How soon? How widely?

Since these off-list questions seem ultimately to have led to the heated discussion during today’s design team meeting, I’d appreciate WG comments on them to help get this issue out of the way as the use cases draft moves toward WGLC. Thanks.

andrew

---

From: "Roland Dobbins" <[email-masked]>
Date: Tue, 18 Jul 2017 22:48:04 +0200

On 18 Jul 2017, at 22:18, Mortensen, Andrew wrote:

>  the replacement of the homenet use case

My view is that the replacement of this use-case is desirable, because 
as written it isn't materially different from the very first use-case, 
and utilizes a lot of verbiage to say essentially the same thing.

It also contains incorrect implications that broadband access network 
operators commonly detect and classify DDoS attacks against their 
user-base via so-called 'DPI' technologies, and that this causes 
scalability problems for those operators.  As noted below, this is not 
actually the case in the majority of broadband access networks.  It 
posits a scenario which does not in fact reflect current and anticipated 
operational reality, and moots a putative problem which is not actually 
prevalent on broadband access networks in the context of DDoS 
mitigation.

The citation of RFC7368 is also unwarranted, in my view.  Whether IPv4 
or IPv6 is utilized, the broadband access network model we see today is 
likely to continue for the foreseeable future, which means that these 
will primarily be eyeball networks.

> * Are DDoS attacks against individual SOHO networks actually that 

Yes, absolutely.  They make up something between ~80% - ~85% of all DDoS 
attacks, by frequency, AFAICT.  We've always seen them, but they've 
grown dramatically over the last 4 years or so - and this increase is 
directly linked to the rise of easily-accessible booter/stresser 
services.

Many large broadband access operators see literally thousands of DDoS 
attacks/day directed towards their users.

> * Are ISPs going to add attack detection capabilities to SOHO CPEs? 

At some point.  It'll be much later in the DOTS adoption cycle.  If we 
foster a decent rate of DOTS adoption, it may be well-nigh universal.

But that would be quite some time from now.  And it's more likely that 
putting DOTS servers into CPE devices in order to suppress 
outbound/crossbound DDoS attack emanating from end-user networks at the 
point of ingress will come first, (which is mischaracterized in the 
HOME-NET write-up as being somehow unsupported by the current proposed 
DOTS architecture), IMHO.

Broadband access operators typically make use of flow telemetry-based 
detection/classification/traceback systems to identify DDoS attacks, 
just as other categories of network operators do.  They also use many of 
the same mitigation techniques, but in different proportions (due to the 
fact that most of the nodes on those networks are clients, not servers 
in IDCs).

So, both their current and medium-term future 
detection/classification/traceback/mitigation strategies are pretty 
similar to those utilized on other types of networks.  The main 
difference is that broadband access networks are also emitters of DDoS 
attacks - either directly from compromised nodes (think Mirai and the 
ilk) or misconfigured CPE devices which are abused as 
reflectors/amplifiers.  So, outbound attack suppression is also a major 
priority for them (as it should be for all network operators; sadly, 
many only focus on inbound attacks and neglect outbound/crossbound).

Their inter- and intra-organizational DOTS architectures will look very 
similar to those of other types of network operators, with the addition 
of a focus on outbound/crossbound attack suppression, which is described 
in the new broadband access network use-case.

-----------------------------------
Roland Dobbins <[email-masked]>

---

From: "Roland Dobbins" <[email-masked]>
Date: Tue, 18 Jul 2017 22:52:40 +0200

On 18 Jul 2017, at 22:48, Roland Dobbins wrote:

> The main difference is that broadband access networks are also 
> emitters of DDoS attacks

This isn't to say that other types of network operators, such as 
colocation, hosting, VPS, IaaS, transit providers aren't also sources of 
DDoS attacks - they often are.  But the operators of broadband access 
networks in particular are very focused on this issue due to the 
widespread collateral impact these outbound/crossbound attacks have on 
user bases often numbering into the tens of millions.

Other types of network operators should also take into account 
outbound/crossbound DDoS attacks, because they can be highly disruptive 
on those networks, as well.  Sadly, awareness of this issue hasn't yet 
permeated as broadly amongst many of these operators as it has on the 
broadband access side of things.

---

From: joel jaeggli <[email-masked]>
Date: Wed, 19 Jul 2017 04:49:33 +0200

> * Are DDoS attacks against individual SOHO networks actually that common?

Yes, or at least common  enough that access-providers have to mitigate
them to protect their own infrastracture, the customer and the customers
neighbors in the case of shared resource access networks.

> * Are ISPs going to add attack detection capabilities to SOHO CPEs? How soon? How widely?

In my experience detection is done via ipfix / sflow and statistical
analysis. and mitigatation is generally done by null routing the
destination, or scrubbing (i've seen your gear doing this albiet nowhere
near the access network), or occasionally with recourse to something
like bgp flowspec. null-routing a customer ip obviously has implications
for being able to communicate with it depending where that route is
install), obviously inband bidirectional communication with a cpe may be
hard when the link to it is melting.

> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots
>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 19 Jul 2017 05:47:00 +0000

> -----Original Message-----
> From: Dots [mailto:[email-masked]] On Behalf Of Roland Dobbins
> Sent: Wednesday, July 19, 2017 2:18 AM
> To: [email-masked]
> Subject: Re: [Dots] homenet use case questions
> 
> 
> My view is that the replacement of this use-case is desirable, because as
> written it isn't materially different from the very first use-case, and utilizes a
> lot of verbiage to say essentially the same thing.
> 
> operators commonly detect and classify DDoS attacks against their user-base
> via so-called 'DPI' technologies, and that this causes scalability problems for
> those operators.  As noted below, this is not actually the case in the majority
> of broadband access networks.  It posits a scenario which does not in fact
> reflect current and anticipated operational reality, and moots a putative
> problem which is not actually prevalent on broadband access networks in the
> context of DDoS mitigation.
> 
> The citation of RFC7368 is also unwarranted, in my view.  Whether IPv4 or
> IPv6 is utilized, the broadband access network model we see today is likely to
> continue for the foreseeable future, which means that these will primarily be
> eyeball networks.
> 
> attacks, by frequency, AFAICT.  We've always seen them, but they've grown
> dramatically over the last 4 years or so - and this increase is directly linked to
> the rise of easily-accessible booter/stresser services.
> 
> At some point.  It'll be much later in the DOTS adoption cycle.  If we foster a
> decent rate of DOTS adoption, it may be well-nigh universal.
> 
> outbound/crossbound DDoS attack emanating from end-user networks at
> the point of ingress will come first, (which is mischaracterized in the HOME-
> NET write-up as being somehow unsupported by the current proposed DOTS
> architecture), IMHO.
> 
> detection/classification/traceback systems to identify DDoS attacks, just as
> other categories of network operators do.  They also use many of the same
> mitigation techniques, but in different proportions (due to the fact that most
> of the nodes on those networks are clients, not servers in IDCs)

Home networks also have servers that could be accessed anywhere from the internet and could be subjected to DDoS attacks (see the discussion in https://tools.ietf.org/html/rfc7368#section-3.7.4 and a home network example in slide 8 of https://ripe64.ripe.net/presentations/179-ripe64_homenet_exp.pdf used demonstrate the complexity of a home network). 
CPE has to act as DOTS client to request mitigation for these servers and also act as a DOTS server to learn about the compromised devices in the home network launching DDoS attacks and to suppress the DDoS attack from these devices. Further, the DOTS server on the CPE could itself be subjected to DDoS attacks.  Homenet needs a special mention because the CPE needs to play dual role, but I agree that the text associated with the homenet use case can be simplified.

-Tiru

> detection/classification/traceback/mitigation strategies are pretty similar to
> those utilized on other types of networks.  The main difference is that
> broadband access networks are also emitters of DDoS attacks - either directly
> from compromised nodes (think Mirai and the
> ilk) or misconfigured CPE devices which are abused as reflectors/amplifiers.
> So, outbound attack suppression is also a major priority for them (as it
> should be for all network operators; sadly, many only focus on inbound
> attacks and neglect outbound/crossbound).
> 
> Their inter- and intra-organizational DOTS architectures will look very similar
> to those of other types of network operators, with the addition of a focus on
> outbound/crossbound attack suppression, which is described in the new
> broadband access network use-case.
>

---

From: "Dobbins, Roland" <[email-masked]>
Date: Wed, 19 Jul 2017 05:59:51 +0000

On Jul 19, 2017, at 07:48, Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>> wrote:

Home networks also have servers that could be accessed anywhere from the internet and could be subjected to DDoS attack

In theory, yes. In practice, it's extremely rare.

Again, broadband access providers utilize common mechanisms to detect/classify/traceback DDoS attacks against their user base.

At some point in the future, CPE devices will likely feature DOTS client capability.  But it isn't an urgent need - DOTS server capability is actually of more value in order to suppress outbound/crossbound DDoS attacks.

-----------------------------------
Roland Dobbins <[email-masked]<mailto:[email-masked]>>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 19 Jul 2017 06:19:10 +0000

From: Dobbins, Roland [mailto:[email-masked]]
Sent: Wednesday, July 19, 2017 11:30 AM
To: Konda, Tirumaleswar Reddy <[email-masked]>
Cc: [email-masked]
Subject: Re: [Dots] homenet use case questions

[TR] We don’t know for sure if it’s extremely rare, homenet architecture discusses devices in the home network acting as servers.

[TR] Sure, I don’t disagree.

[TR] If CPE devices is going to get upgraded to act as DOTS server then should also be upgraded to act as DOTS client to protect itself and its resources from DDoS attacks.

-Tiru

---

From: "Dobbins, Roland" <[email-masked]>
Date: Wed, 19 Jul 2017 06:34:59 +0000

On Jul 19, 2017, at 08:19, Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>> wrote:

TR] We don’t know for sure if it’s extremely rare, homenet architecture discusses devices in the home network acting as servers.
Yes, we do know it's extremely rare in the real world.  At some point in the far future, that may change - but not for a long time.
 [TR] If CPE devices is going to get upgraded to act as DOTS server then should also be upgraded to act as DOTS client to protect itself and its resources from DDoS attacks.

One would think that, & we should encourage it.

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 19 Jul 2017 06:50:15 +0000

From: Dobbins, Roland [mailto:[email-masked]]
Sent: Wednesday, July 19, 2017 12:05 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>
Cc: [email-masked]
Subject: Re: [Dots] homenet use case questions

The draft once it becomes an RFC will be referred for a long time ☺; just like the use case about the mobile device acting as DOTS client may not happen immediately but seems possible once Trusted Execution environment is available on Mobile devices to run the DOTS client as a secure app over secure OS and the credentials to authenticate to the DOTS server won’t be available to malware on the rich OS
(see https://www.ietf.org/proceedings/99/slides/slides-99-edu-sessi-trusted-execution-environments-tee-and-the-open-trust-protocol-otrp-01.pdf) .

-Tiru

---

From: kaname nishizuka <[email-masked]>
Date: Wed, 19 Jul 2017 09:53:36 +0200

> * Are DDoS attacks against individual SOHO networks actually that common?
Yes, it's common. For example, in an ISP with ~3M users in Japan, they observe ~1Gbps attack at least once a week in average.
In order to protect users in the same aggregation router/switch which suffer from such attacks, we tend to use blackholing/acl technologies  (using mitigation boxes is a richer option for the protection)
How to automate it by the DOTS protocol should be addressed by our WG.

> * Are ISPs going to add attack detection capabilities to SOHO CPEs? How soon? How widely?
Yes, but from operator's point of view, there are options 1) DOTS client resides in CPE,  2) DOTS client resides in some monitoring system managed by ISP.
2) is easy to accomplish because attack detection capabilities already exist in some monitoring system of the broadband access network.
1) is only in planning phase, but we are trying to figure out that DOTS is worth to be deployed in (managed) CPE devices.

We haven't think about DOTS server resides in CPE,  because when we want to stop outgoing DDoS attacks from subscribers, we can do it on our access network.

kaname

---

From: "Dobbins, Roland" <[email-masked]>
Date: Wed, 19 Jul 2017 08:00:36 +0000

On Jul 19, 2017, at 09:50, kaname nishizuka <[email-masked]<mailto:[email-masked]>> wrote:

Yes, this is the common approach.  Using DOTS to trigger suppression and/or quarantine is a potentially useful application, IMHO.