RE: [gnso-ff-pdp-may08] Proposed additional text, section 5, following line 308

["Greg Aaron" <gaaron@xxxxxxxxxxxx>]

I like Joe's additions, but would add some material to read thusly:

"If constraints were to be applied to TTLs in an effort to limit fastflux,
this would impact organizations which rely on short TTLs in order to be able
to relocate resources as part of the process of mitigating distributed
denial of service attacks, would impact organizations moving namservers, and
would impact organizations which rely on short TTLs in order to provide a
variety of legitimate services, among others."

There are a ton of services that use short TTLs.

All best,
--Greg



-----Original Message-----
From: owner-gnso-ff-pdp-may08@xxxxxxxxx
[mailto:owner-gnso-ff-pdp-may08@xxxxxxxxx] On Behalf Of Joe St Sauver
Sent: Tuesday, September 02, 2008 1:21 PM
To: gnso-ff-pdp-May08@xxxxxxxxx
Subject: [gnso-ff-pdp-may08] Proposed additional text, section 5, following
line 308


Lines 304-308 in Section 5, PDF page 15, read:

   "1. Organizations that operate highly targetable networks
   
   Organizations that operate highly targetable networks (e.g., government 
   and military/tactical networks) that must adhere to very stringent 
   availability metrics and use short TTLs to rapidly relocate network 
   resources which may come under attack[.]"

The draft report does not explain why that scenario is relevant to 
a discussion of fastflux. Proposed additional text following line 308
meant to correct that:

   "While those sort of networks employ short TTLs, short TTLs -- in and 
   of themselves -- are insufficient to characterize a domain name as 
   'fastflux.'

   "TTLs become an issue for fastflux-related work primarily because at 
   least one Internet Draft, ftp://ftp.rfc-editor.org/in-notes/interne
   t-drafts/draft-bambenek-doubleflux-01.txt (URL broken due to length) 
   focuses primarily on establishing minimum TTLs as an approach to 
   limiting fastflux. If constraints were to be applied to TTLs in an 
   effort to limit fastflux, this would impact organizations which rely 
   on short TTLs in order to be able to relocate resources as part of 
   the process of mitigating distributed denial of service attacks."

Regards,

Joe

Disclaimer: all opinions strictly my own