Subject: [Dots] My comments for DOTS architecture -05 draft:

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 4 Dec 2017 04:10:40 +0000

Hi,
This version is already pretty mature and stable to go to next stage in my personal opinion, some minor comments are as below:

1.         In section 1.2, the sentence "as when aggregating intra-domain DOTS client signals for inter-domain coordinated attack response" is not so clear to me. Is it possible for the intra-domain coordinated attack response use cases?

2.         In section 2, you have mentioned both client (attack target) health information and efficacy information, which are the same in current protocol draft. Can you clarify your definition of them?

3.         For the whole document, please double check the Figure title. Some of them are not align with the same style of capital of every word.

4.         For data channel information, we have identifiers, BL/WL, filtering and provisioning now. But I don't think we had a crystal definition for part of them, even the difference among them. More specifically, BL/WL vs filtering, what is the provisioning?

5.         In the beginning paragraphs of section 2.1 about DOTS operations, the binding relation between signal and data channel is missed, no matter they are really bound by DOTS agents ID (i.e., address, credential info, others) or are not necessarily bound.

6.         In the first paragraph of P9, an attack mitigation request does not necessarily result in traffic redirection, right?

7.         In Figure 13, "1" should be "2":)

Thanks for your excellent work!

B.R.
Frank