Subject: [ipfix-arch] Qs on DoS sections

From: Ganesh Sadasivan <[email-masked]>
Date: Thu, 21 Feb 2002 18:36:07 -0800

Hi,
Some questions DoS sections:

7.3.1. Network under attack

The Network itself may be under attack, resulting in an overwhelming
number of IPFIX messages. The IPFIX SHOULD try to capture as much
information as possible. However, when large amount IPFIX messages
are generated in a short period of time, the IPFIX may become
overloaded. The IPFIX system MUST provide enough performance
assurance so that the system can still function under heavy load.
Possible solutions include flow control and message thresholding.

Q: What has "enough performance  assurance" got to do with
"flow control and message thresholding"? I guess it should be
that "IPFIX system should be able to detect and react quickly
to an overload condition". For something which
cannot be clearly quantified, "MUST" seems to be too harsh.

7.3.2. Generic DoS attack on the IPFIX system

The IPFIX system may subject to generic DoS attacks, just as any
system on any open networks. These types of attacks are not IPFIX
specific. Preventing and responding to such types of attacks are out
of the scope of IPFIX WG.

Q: Is this not a special case of 7.3.1?

Thanks
Ganesh

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: <[email-masked]>
Date: Fri, 22 Feb 2002 05:20:59 -0500

Hello Ganesh,

See my inline comments.

>Q: Is this not a special case of 7.3.1?

Currently mechanism like Ingress filtering, Traceback etc... are the 
mechanism to detect or prevent Dos attacks but they are not widely adopted
in the Internet.

This is the reason the Dos attacks is not in the scope of IPFIX. 

May be we have to reword this sentence, simply as Dos attacks are not part of 
the scope rather than a lengthy statement.

I am not sure of 7.3.1, may be cliff or paul can comment on that.

regards
ramg

---

From: "Wang, Cliff" <[email-masked]>
Date: Fri, 22 Feb 2002 14:41:55 -0000

Comments inline.

-----Original Message-----
From: Ganesh Sadasivan [mailto:[email-masked]] 
Sent: Thursday, February 21, 2002 9:36 PM
To: [email-masked]
Subject: [ipfix-arch] Qs on DoS sections

Hi,

The Network itself may be under attack, resulting in an overwhelming number
of IPFIX messages. The IPFIX SHOULD try to capture as much information as
possible. However, when large amount IPFIX messages are generated in a short
period of time, the IPFIX may become overloaded. The IPFIX system MUST
provide enough performance assurance so that the system can still function
under heavy load. Possible solutions include flow control and message
thresholding.

Q: What has "enough performance  assurance" got to do with "flow control and
message thresholding"? I guess it should be that "IPFIX system should be
able to detect and react quickly to an overload condition". For something
which cannot be clearly quantified, "MUST" seems to be too harsh.

[cliff] one of the potential usage of IPFIX is for intrusion detection. When
the network is under attack, it may heavily load the IPFIX system. To be
able to report the network status, IPFIX system needs to have some mechanism
(yet to be defined) to guarantee that enough flow information is captured so
that ID can detect the attack and then respond accordingly. Whether it is a
"SHOULD" or "MUST" is open for discussion. But in my opinion, to be able to
support IDS, it seems to be a "MUST".

The IPFIX system may subject to generic DoS attacks, just as any system on
any open networks. These types of attacks are not IPFIX specific. Preventing
and responding to such types of attacks are out of the scope of IPFIX WG.

[cliff] 7.3.1 refers to the network under attack, where the IPFIX system
itself it not the direct target of the attack. 7.3.2 refers to the case that
either the probe or the collector is under direct attack. We probably should
update the text to be more clear.