[gnso-ff-pdp-may08] Proposed additional text, section 5, following line 308

[Joe St Sauver <joe@xxxxxxxxxxxxxxxxxx>]

Lines 304-308 in Section 5, PDF page 15, read:

   "1. Organizations that operate highly targetable networks
   
   Organizations that operate highly targetable networks (e.g., government 
   and military/tactical networks) that must adhere to very stringent 
   availability metrics and use short TTLs to rapidly relocate network 
   resources which may come under attack[.]"

The draft report does not explain why that scenario is relevant to 
a discussion of fastflux. Proposed additional text following line 308
meant to correct that:

   "While those sort of networks employ short TTLs, short TTLs -- in and 
   of themselves -- are insufficient to characterize a domain name as 
   'fastflux.'

   "TTLs become an issue for fastflux-related work primarily because at 
   least one Internet Draft, ftp://ftp.rfc-editor.org/in-notes/interne
   t-drafts/draft-bambenek-doubleflux-01.txt (URL broken due to length) 
   focuses primarily on establishing minimum TTLs as an approach to 
   limiting fastflux. If constraints were to be applied to TTLs in an 
   effort to limit fastflux, this would impact organizations which rely 
   on short TTLs in order to be able to relocate resources as part of 
   the process of mitigating distributed denial of service attacks."

Regards,

Joe

Disclaimer: all opinions strictly my own