Subject: [Dots] What kind of capability does DOTS client have?

From: Linda Dunbar <[email-masked]>
Date: Sat, 2 Apr 2016 15:22:21 +0000

Roland,

Reading through the draft-ietf-dots-use-cases-01, it is not clear to me what kind of capability should a DOTS client have?
Does  CPE or PE act like a DOTS client?
Or is it an end device, a VM, an application? Like an email server, or Sharepoint App? I would assume that most applications are directly managed/monitored by its management system. Is the Management  (or the monitoring) system act like DOTS client?

Does DOTS charter cover how/when an entity decide to send out request for upstream mitigation service ?
Section 3.1.4 states that an application which is the target of DDoS attack can be a DOTS client. Do many applications deployed today have the ability to request DOTS mitigation?

How do DOTS clients know who is its upstream DOTS mitigator?

Section 3.1.5:
When an organization has reason to believe that it is under active attack, why can't the authorized personnel send mitigation requests directly?

Thanks, Linda

---

From: "Roland Dobbins" <[email-masked]>
Date: Sun, 03 Apr 2016 11:55:55 +0700

> Does  CPE or PE act like a DOTS client?

It certainly could - see Section 3.11, Section 3.12, and Section 3.13, 
as well as the -00 .pdf preso at 
<https://app.box.com/s/pxdectifypevcvcyu1mm3fncvpv1mum4> (soon to be 
revved for -01).

> Or is it an end device

Sure, see section 3.1.2.

> a VM

Yes.

> an application?

Certainly.

> Like an email server, or Sharepoint App?

Absolutely.  Copious amounts of SMTP backscatter from a joe-job often 
constitute a layer-7 DDoS attack on an MTA, for example.

> I would assume that most applications are directly managed/monitored 
> by its management system.

Some are, some aren't.

> Is the Management  (or the monitoring) system act like DOTS client?

Yes, definitely.

> Do many applications deployed today have the ability to request DOTS 
> mitigation?

Some do - BIND and Apache are listed as two examples.  fail2ban and 
other things of a similar nature could be utilized to do this based upon 
repetitive abusive requests which constitute a layer-7 DDoS attack for 
lots of other applications (for example, aggressive ssh brute-forcing 
which ends up causing a service outage).

The idea is that there are some which can do so now, and, once a 
standards-based mechanism for doing so is available, more applications 
and services and management systems will be enhanced with this 
capability.

> How do DOTS clients know who is its upstream DOTS mitigator?

That information is configured within the application.  In 3.1.4, '. . . 
may be configured so that upon detecting and classifying a DDoS attack, 
it signals one or more DOTS servers . . . '.

> When an organization has reason to believe that it is under active 
> attack, why can't the authorized personnel send mitigation requests 
> directly?

Because in that scenario, they're using a Web browser to connect to a 
remote system which speaks DOTS.  The Web browser speaks http/s, in that 
example; the user clicks the button in the Web UI, which then initiates 
the DOTS request.  Again, see the -00 preso.

-----------------------------------
Roland Dobbins <[email-masked]>