Subject: Re: [Dots] Overlap with DOTS drafts to MILE

From: "Hedanping (Ana)" <[email-masked]>
Date: Mon, 20 Apr 2015 07:34:49 +0000

Hi Roman, 
Thanks for the comment. I think this thread is a good place to discuss the gap/relationship between DOTS and MILE, which is also mentioned by Daniel. 
I have some doubts, please see my reply inline.

  >-----Original Message-----
  >From: Dots [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
  >Sent: Tuesday, March 24, 2015 11:48 PM
  >To: [email-masked]
  >Subject: [Dots] Overlap with DOTS drafts to MILE
  >
  >Hello!
  >
  >BOF chair hat off ...
  >
  >Ignoring the necessary discussion on whether XML is appropriate occurring on
  >a separate thread, I conducted a superficial crosswalk of
  >draft-teague-open-threat-signaling-00 and draft-fu-ipfix-network-security
  >against existing MILE drafts to see how the information models line up.
  >There is some overlap.  These observations are anecdotally enumerated
  >below.  A more detailed analysis would be required if an XML representation
  >or linkages with MILE was deemed appropriate.
  >
  >Both DOTS drafts have various counters in their IPFIX information models,
  >MILE's IODEF (draft-ietf-mile-rfc5070-bis-11) can represent many of the them.
  >For example, draft-fu-ipfix-network-security's tcpFinTotalCount field would
  >look as follows in IODEF:
  >
  ><System>
  >  <Node>
  >    <Address enum="ipv4-addr">1.2.3.4</Address>
  >  </Node>
  >  <Service ip-protocol="6">
  >     <ProtoField>1</ProtoField>
  >  </Service>
  >  <Counter type="flow" duration="second">29234</Counter> </System>
  >

Allow me also first ignore whether xml is appropriate. IMO, IODEF should provide flow representation if it is used to represent IPFIX parameters of several sampled flows, is it possible?

Cheers,
Ana
 
  >However, there are certain counters such as
  >draft-teague-open-threat-signaling's Typical Pps that IODEF does not
  >represent.
  >
  >draft-teague-open-threat-signaling encodes threat information which IODEF
  >appears could represent in the Method class.
  >
  >Finally, there are packet specific features of flows (e.g.,
  >draft-fu-ipfix-network-security's maximumIpTotalLength) that IODEF doesn't
  >represent.  Likewise, most of the elements of
  >draft-teague-open-threat-signaling's JSON channel don't align with MILE's RID
  >or IODEF.
  >
  >In most cases where IODEF is lacking, there appears to be a way to create an
  >extension.
  >
  >Roman
  >_______________________________________________
  >Dots mailing list
  >[email-masked]
  >https://www.ietf.org/mailman/listinfo/dots