Subject: [Dots] I-D Action: draft-ietf-dots-requirements-13.txt

From: [email-masked]
Date: Wed, 07 Feb 2018 09:05:38 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DDoS Open Threat Signaling WG of the IETF.

        Title           : Distributed Denial of Service (DDoS) Open Threat Signaling Requirements
        Authors         : Andrew Mortensen
                          Robert Moskowitz
                          Tirumaleswar Reddy
	Filename        : draft-ietf-dots-requirements-13.txt
	Pages           : 20
	Date            : 2018-02-07

Abstract:
   This document defines the requirements for the Distributed Denial of
   Service (DDoS) Open Threat Signaling (DOTS) protocols enabling
   coordinated response to DDoS attacks.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dots-requirements/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dots-requirements-13
https://datatracker.ietf.org/doc/html/draft-ietf-dots-requirements-13

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dots-requirements-13

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Mortensen, Andrew" <[email-masked]>
Date: Wed, 7 Feb 2018 17:08:52 +0000

Not wanting to lose momentum from today’s interim meeting, I’ve updated the requirements draft to address the remaining issues. Please take a close look at GEN-004 and -005, which add the mitigation hinting and loop handling general requirements, respectively. As discussed during today’s meeting, the bidirectionality requirement (formerly GEN-003) has been moved under the signal channel requirements as SIG-003.

andrew

Begin forwarded message:

From: [email-masked]<mailto:[email-masked]>
Subject: [Dots] I-D Action: draft-ietf-dots-requirements-13.txt
Date: February 7, 2018 at 12:05:38 PM EST
To: <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>

Abstract:

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 8 Feb 2018 03:26:57 +0000

1)
  GEN-005  Loop Handling: In specific scenarios, it may be possible for
      communication between DOTS agents to loop, for example as a result
      of misconfiguration or aggressive caching.

comment> The looping attack Jon discussed in the mailing list is because of misconfiguration
and DNS cache poisoning. What do you mean by "aggressive caching" ?

2)  Mitigation hints MAY be transmitted across either signal or data channel.

comment> I don't think the DOTS client will know the mitigation hints during peace time to convey the hints in the data channel !

-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Mortensen, Andrew
Sent: Wednesday, February 7, 2018 10:39 PM
To: dots <[email-masked]>
Subject: [Dots] Fwd: I-D Action: draft-ietf-dots-requirements-13.txt

andrew

Begin forwarded message:

Abstract:

---

From: "Mortensen, Andrew" <[email-masked]>
Date: Thu, 8 Feb 2018 05:04:08 +0000

On Feb 7, 2018, at 10:26 PM, Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>> wrote:

1)

comment> The looping attack Jon discussed in the mailing list is because of misconfiguration
and DNS cache poisoning. What do you mean by "aggressive caching” ?

Sorry, I had meant to provide a specific example of misconfiguration, and didn’t finish the thought. I’m skeptical of the DNS cache poisoning example for the same reason you cited on the list.

I had in mind always-on mitigation. I wanted to leave open the possibility that the DOTS client operators might provide hints to inform the shape of that always-on mitigation. Since the conversation leading to this requirement addition concluded with what seemed to be an agreement that we wanted to create space for undefined forms of hinting, it seemed reasonable to assume a DOTS operator could have some form of threat intelligence which could be provided in such a scenario.

andrew

From: Dots [mailto:[email-masked]] On Behalf Of Mortensen, Andrew
Sent: Wednesday, February 7, 2018 10:39 PM
To: dots <[email-masked]<mailto:[email-masked]>>
Subject: [Dots] Fwd: I-D Action: draft-ietf-dots-requirements-13.txt

andrew

Begin forwarded message:

Abstract:

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 8 Feb 2018 05:36:35 +0000

From: Mortensen, Andrew [mailto:[email-masked]]
Sent: Thursday, February 8, 2018 10:34 AM
To: Konda, Tirumaleswar Reddy <[email-masked]>
Cc: dots <[email-masked]>
Subject: Re: [Dots] Fwd: I-D Action: draft-ietf-dots-requirements-13.txt

1)

Let’s remove “aggressive caching”.

Got it, thanks.

Cheers,
-Tiru

andrew

andrew

Begin forwarded message:

Abstract: