Subject: [Mud] Building out an ARF-like capability

From: Eliot Lear <[email-masked]>
Date: Fri, 21 Jun 2019 14:26:52 +0200

Hi,

I’m in mid draft write on this. In A World in which the device with a mud url and mud file has its packet administratively dropped, there are a good number of possible reasons:

No controllers
No devices of same manufacturer/model/ etc.
Name not resolving in ACL
Mismatch between what the name is resolving to and what the enforcement point is allowing
Misconfigured MUD file due to device using stuff that’s not there
Owned device using stuff it shouldn’t

In all of these cases, the question arises: who wants what in a report?

Deployment:
Mappings at the time of drop
5-tuple

Manufacturer:
Limited mappings at time of drop (we don’t want internal IP addresses leaving the deployment)
A counter to indicate if the abstractions are filled out
IP addresses of stuff using the dnsname in an ACL
L4 info??

What else?

Eliot