Subject: Re: [OPSEC] Review of: draft-ietf-opsec-ip-options-filtering-02

From: Merike Kaeo <[email-masked]>
Date: Sat, 06 Jul 2013 08:53:25 -0700

Hi..

I will send my comments to list right after this reply but have a comment on one of Arturo's comments.
For readability I have gotten rid of everything except the one point I want to make:

> >>> Section 4.22.5
> >>> 
> >>> The advice mentions "drop and log event" as the default. I wonder that
> >>> if logging a large amount of packets with these options would create a
> >>> DoS on the control plane. Perhaps the default should be just drop or
> to
> >>> add an advice that excessive logging could also be an attack vector.
> >>> 
> >>> Same for 4.23.4 about "Other IP options" and in general every time
> that
> >>> the document recommends "drop and logging".

I'm a firm believer of logging exceptions (i.e. packets you are dropping) so that you see where these packets that you shouldn't be seeing are coming from and can mitigate issue as needed.  It's probably not a bad idea to have a statement to say that excessive logging can be a DoS although I do hope people would be monitoring and setting thresholds for abnormally high counts and acting on that.  [one can hope] :)

- merike

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Sat, 6 Jul 2013 17:04:01 +0000

Merike,

Please see inline. 

Thumb typed by Carlos Pignataro.
Excuze typofraphicak errows

> I'm a firm believer of logging exceptions (i.e. packets you are dropping) so that you see where these packets that you shouldn't be seeing are coming from and can mitigate issue as needed.  It's pr…

Thanks. There is a difference between counting drops and logging drops. We will take care of this in the next rev. 

Thanks,

> - merike

Carlos.