Subject: [Dots] Reg some doubts over DOTS USe cases document draft-ietf-dots-use-cases-07

From: Mayank Bhatnagar <[email-masked]>
Date: Thu, 31 Aug 2017 17:40:26 +0530

hi all,

I am Mayank Bhatnagar, aiming for discussions & paritcipations in the
project. I have started reading the use cases, ref architecture and
requirements.

Here are some doubts wrt the Use cases document.
If anyone can point out (yes or no) that these may have been addressed or
are not part of scope of the work, please comment so that I can base my
understanding further.

thanks a lot for your time,
regards,
Mayank Bhatnagar

================================================

1. DOTS client and DOTs server
After reading the same I assume the standard aims to have a DOTS client
installed with an end customer in form of an Internet facing end entity or
the web server.
Please cofnirm if following is in afirmative
- An organisation should have to necessariy install a DOTS client if it has
to reach out to a DOTS server
- If in case of situation of 3.1.4 of draft-ietf-dots-use-cases-07, it is
assumed an organisation already may or may not have an on-premise
mitigation capability. Then do we assume they need to install DOTS client?

Home Network, CPE collaboration with upstream ISP vendors's DDoS mitigation
system
- It is imp to note that the traffic which may be suspicious for a MSSP may
be normal for a home or SOHO based customer, hence a DOTS server at MSSP
may enquire a suspicious traffic.
However my query is that a DDoS is not always a single flow. To relate a
particular traffic and idenfity it so that it can be queried from a DOTS
server at MSSP with a CPE router having a DOTS client, is not easy. These 2
entities need to define the characteristics of the traffic.
So, we can add to the models of the various means to characterise the
traffic so that these 2 entities can discuss it wthout human intervention?

DOTS between MSSP and DDoS information Sharing model
- Does DOTS Orchestrator discusses the DDoS information wth other clients
of MSSP or shares it with other DOTS entities for a proactive response
action
It could happen the DDoS attack is happening across the clients of MSSP
Is this part of Orchestrator responsibilites too?

================================================