Subject: [Dots] source-ip-prefix in signal mitigation request.

From: "Jon Shallow" <[email-masked]>
Date: Fri, 29 Dec 2017 16:17:01 -0000

Hi WG,

Currently, the signal spec only allows for target-* definitions with the
option for Vendor-Specific CBOR Key values.

We have already seen from ietf-100 interoperability tests that there is
potentially already one Vendor-Specific definition of source-ip-prefix.

Does it make sense to have "source-ip-prefix" as a standard, optional
parameter?

There will be a limitation of number of source IPs that can be defined due
to packet MTU.

The mitigation overlapping rules (e.g. same "target-ip") where the highest
"mitigation-id" is the active rule will also constrain the number of source
IPs.

It does however give the flexibility of, say, temporarily black-listing
certain IPs that an intelligent DOTS client has determined to be the most
active in an attack.

Comments?

Regards

Jon