Subject: [Dots] Feedback on draft-ietf-dots-use-cases-06

From: Roman Danyliw <[email-masked]>
Date: Tue, 18 Jul 2017 09:50:40 +0000

Hello!

(Hat off)

I read the updated (-06) use case document (draft-ietf-dots-use-cases) and wanted to share my observations and comments on this significantly revised version.  They are as follows:

(1) Section 1, There are numerous uses of the convention where multiple nouns are concatenated with a slash (e.g., "solution/services", "vendor/service"), I'd recommend avoiding this style.

(2) Section 1, paragraph 1.  The third sentence, "Additionally, coordination of multiple ..." does not follow for me from the first two sentences or the concluding fourth sentence.

(3) Section 1, paragraph 2.  "... are broadly heterogeneous among different vendors ...".  The use of 'different' seems redundant to ' heterogeneous' already being used.  Also, per "... primary goal for DOTS is to provide a high level interaction ...", I'd be clearer and say protocol (not interaction).

s/As DDoS solutions/services are broadly heterogeneous among different vendors, the primary goal for DOTS is to provide a high level interaction with these DDoS solutions/services such as initiating or terminating DDoS mitigation assistance./
As DDoS solutions and services are heterogeneous, the primary goal for DOTS is to provide a protocol for these DDoS solutions and services to interact./

(4) Section 1, paragraph 3.  I wouldn't call out I2NSF explicitly as this reference will become dated over time and simply state "no orchestration".

s/It should be noted that DOTS is not in and of itself intended to perform orchestration functions duplicative of the functionality being developed by the [I2NSF] WG; rather, DOTS is intended to allow devices, services, and applications to request DDoS attack mitigation assistance and receive mitigation status updates from systems of this nature./
DOTS is not intended to perform orchestration.  Rather, DOTS intends to allow devices, services, and applications to request DDoS attack mitigation assistance and receive mitigation status updates./

(5) Section 1, paragraph 4.  IMO, "The use cases ... presented ..." sentence would be clearer without references to DOTS-enabled nodes.

s/The use cases presented in the document are intended to provide examples of communications interactions DOTS-enabled nodes in both inter- and intra-organizational DDoS mitigation scenarios./
The use cases presented in the document are intended to provide examples of communications interactions in DDoS mitigation scenarios./

(6) Section 3, An inconsistent style observation -- the use case titles use the convention "end customer".  However, in the write-ups of these use cases, "enterprise" is used.  I'd recommend choosing one style.

(7) Section 3.1.1, For me, the specificity of this use case (i.e., the specific call out of an IDMS, the details of the provisioning) buried the what should have been the simplest of use cases -- a single homed customer requesting help from an upstream.

(8) Section 3.1.2, The second sentence of the second paragraph, "However, if two or more ..." was long and difficult to parse for me.  I'd recommend decomposing it.

(9) Section 3.1.3, The difference in network topology of this use case from 3.1.2 is clearly stated.  How this difference manifests for DOTS isn't coming through for me in this text.

(10) Section 3.1.4, Are the constraints defined in the opening sentence, "an enterprise that has a local DDoS detection and classification capability and may or may not have an on-premise mitigation capability", necessary to scope this use case.   It seems to me that the second sentence is the key detail, "[t]he enterprise is contracted with an overlay DDoS mitigation service".

(11) Section 3.1.5, 3.1.6, These examples don't seem that different than the base 3.1.1 example.

(12) Section 3.2.1, The use case title was clear.  However, the write-up mixed descriptions of attack patterns with different network types with how telemetry could be used.  This level of detail made this use case difficult to follow for me.

(13) Section 3.2.2, The opening sentence of the first paragraph is not a complete sentence, "In this use case, one or multiple telemetry systems or monitoring devices like a flow collector monitor a network -- typically an ISP network.".  Perhaps, it could be restated as ...

s/In this use case, one or multiple telemetry systems or monitoring devices like a flow collector monitor a network -- typically an ISP network/
In this use case, one or more telemetry systems are deployed in the enterprise/

(14) Section 3.2.2, There are various references to an orchestrator and what it does in this section.  However, in Section 1, it is stated that DOTS does not perform orchestration.  This seems incongruent to me.

Roman