Subject: Re: [Mud] Simplified Quarantine model

From: tirumal reddy <[email-masked]>
Date: Tue, 21 May 2019 12:33:12 +0530

How do you identify an attacker is using the victim device's MAC and IP
address to send attack traffic (e.g. SYN flood) ?

The problem I am facing is victim device can possibly get quarantined based
on the attack traffic from the attacker spoofing MAC and IP addresses.
Normal traffic from victim's device will end-up getting blocked, and the
compromised device in the home can quarantine other normal devices.

-Tiru

On Tue, 30 Apr 2019 at 21:23, M. Ranganathan <[email-masked]> wrote:

>
> Hello,
>
> I have been reading
>
> https://tools.ietf.org/html/draft-richardson-shg-un-quarantine-00
>
> and
>
>
> https://tools.ietf.org/html/draft-richardson-shg-un-quarantine-00#ref-I-D.richardson-shg-mud-quarantined-access
>
> I am wondering if these different states defined in the model need to be
> defined.
>
> I would like to collapse these to only two states :
>
> 1. Normal operation --  a device is operating normally and has not
> violated any access rules.
> 2. Quarantined  - A device that misbehaves (packets originating from the
> device cause an access violation) is sent to the quarantined state. A
> device is allowed to access those ACEs tagged for quarantined access while
> in the quarantined state.
>
> The system should inform the device administrator under these conditions.
> While under quarantine, only the tagged ACE's are allowed i.e. as defined
> in :
>
>
> https://tools.ietf.org/html/draft-richardson-shg-un-quarantine-00#ref-I-D.richardson-shg-mud-quarantined-access
>
> If the device violates its normal ACEs it gets put into the "Quarantine"
> state and it remains in that state until the administrator takes whatever
> administrative action needs to be taken and changes the state to "Normal".
> The manner in which the administrator does this is implementation dependent
> (not part of the standard). This can include downloading the firmware
> update and flashing it or somehow signaling the device to update itself.
>
> Any comments on the above?
>
> Thanks,
>
> Ranga
>
>
> --
> M. Ranganathan
>
> --
> You received this message because you are subscribed to the Google Groups
> "mud-discuss" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email-masked].
> To post to this group, send email to [email-masked].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/mud-discuss/CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ%40mail.gmail.com
> <https://groups.google.com/d/msgid/mud-discuss/CAHiu4JM3oZkXzasiqF9vYzrHFsvDvR446evShQBAXnW46nNXdQ%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
> For more options, visit https://groups.google.com/d/optout.
>