Subject: [Dots] My comments on draft-mglt-dots-use-cases-00:

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 29 Jun 2015 02:59:49 +0000

Hi Daniel,
Thanks for bringing the use case draft for DOTS. I have reviewed it and have some comments on it:
1. In the introduction section, the statement made in the first paragraph "...make DDoS attacks harder to be detected at a single point" is a little vague. I don't think the following examples of this section explain the statement well. They can be detected by one dpi device nowadays in fact, which only needs more fine-grained monitoring and more detecting intelligence, i.e., signature, session state analysis, etc. The coordination between distributed anti-ddos system aims for not only detecting, but also for mitigating with better accuracy, performance and efficiency. Maybe better examples can be on-premise anti-ddos device plus anti-ddos cloud service and attack source tracking, and so on;
2. Actually, dedicated anti-ddos appliance can detect ddos attacks by itself and send the attack infomation to controller directly, not every ddos attacks need to be determined by the controller;
3. The flow repository is not essential in some cases, although it's very important for ddos centralized analysis based on flow information in many cases;
4. For On-premise Asymmetric Use Case, why does it still need ddos monitoring for the outbound traffic if the ddos mitigation function is not provided for it?

FYI, we have submitted another DOTS use cases draft to describe several promising DOTS use cases being complementary to yours, your review and comments are welcome.

Thanks!

B.R.
Frank