SIP Load-Control Namespace (original) (raw)

, , , and. The exact requirement to authenticate and authorize these fields is up to the service provider. In general, if the identity field represents the source of the request, it SHOULD be authenticated and authorized; if the identity field represents the destination of the request, the authentication and authorization is optional. Shen, et al. Standards Track [Page 23] RFC 7200 SIP Load-Control Event Package April 2014 In addition, the "redirect" action (Section 5.4) could facilitate a reflection denial-of-service attack. If a number of SIP proxy servers in a Trust Domain are using UDP and configured to get their policies from a central server. An attacker spoofs the central server's address to send a number of NOTIFY bodies telling the proxy servers to redirect all calls to victim@outside-of-trust-domain.com. The proxy servers then redirect all calls to the victim, who then becomes a victim of Denial of Service attack and becomes inaccessiable from the Internet. To address this type of threat, this specification requires that a Trust Domain agrees on what types of calls can be affected as well as on the destinations to which calls may be redirected, as in Section 3.4. 8. IANA Considerations This specification registers a SIP event package, a new media type, a new XML namespace, and a new XML schema. 8.1. Load-Control Event Package Registration This section registers an event package based on the registration procedures defined in [RFC6665]. Package name: load-control Type: package Published specification: This specification Person to contact: Charles Shen, charles@cs.columbia.edu 8.2. application/load-control+xml Media Type Registration This section registers a new media type based on the procedures defined in [RFC6838] and guidelines in [RFC3023]. Type name: application Subtype name: load-control+xml Required parameters: none Optional parameters: Same as charset parameter of application/xml as specified in [RFC3023]. Encoding considerations: Same as encoding considerations of application/xml as specified in [RFC3023]. Shen, et al. Standards Track [Page 24] RFC 7200 SIP Load-Control Event Package April 2014 Security considerations: See Section 10 of [RFC3023] and Section 7 of this specification. Interoperability considerations: none Published specification: This specification Applications that use this media type: Applications that perform load control of SIP entities. Fragment identifier considerations: Same as fragment identifier considerations of application/xml as specified in [RFC3023]. Additional Information: Deprecated alias names for this type: none Magic Number(s): none File Extension(s): .xml Macintosh file type code(s): "TEXT" Person and email address for further information: Charles Shen, charles@cs.columbia.edu Intended usage: COMMON Restrictions on usage: none Author: Charles Shen, Henning Schulzrinne, Arata Koike Change controller: IESG Provisional registration? (standards tree only): no 8.3. URN Sub-Namespace Registration This section registers a new XML namespace, as per the guidelines in [RFC3688] URI: The URI for this namespace is urn:ietf:params:xml:ns:load-control Registrant Contact: IETF SOC Working Group sip-overload@ietf.org, as designated by the IESG iesg@ietf.org Shen, et al. Standards Track [Page 25] RFC 7200 SIP Load-Control Event Package April 2014 XML: BEGIN SIP Load-Control Namespace

urn:ietf:params:xml:ns:load-control

See RFC 7200.

END 8.4. Load-Control Schema Registration URI: urn:ietf:params:xml:schema:load-control Registrant Contact: IETF SOC working group, Charles Shen (charles@cs.columbia.edu). XML: the XML schema contained in Section 6 has been registered. Its first line is and its last line is Shen, et al. Standards Track [Page 26] RFC 7200 SIP Load-Control Event Package April 2014 9. Acknowledgements The authors would like to thank Jari Arkko, Richard Barnes, Stewart Bryant, Gonzalo Camarillo, Bruno Chatras, Benoit Claise, Spencer Dawkins, Martin Dolly, Keith Drage, Ashutosh Dutta, Donald Eastlake, Adrian Farrel, Stephen Farrell, Janet Gunn, Vijay Gurbani, Brian Haberman, Volker Hilt, Geoff Hunt, Carolyn Johnson, Hadriel Kaplan, Paul Kyzivat, Barry Leiba, Pearl Liang, Salvatore Loreto, Timothy Moran, Eric Noel, Parthasarathi R, Pete Resnick, Adam Roach, Dan Romascanu, Shida Schubert, Robert Sparks, Martin Stiemerling, Sean Turner, Phil Williams, and other members of the SOC and SIPPING working groups for many helpful comments. In particular, Bruno Chatras proposed the and condition elements along with many other text improvements. Janet Gunn provided detailed text suggestions including Appendix C. Eric Noel suggested clarification on load-filtering policy distribution initialization process. Shida Schubert made many suggestions such as terminology usage. Phil Williams suggested adding support for delta updates. Ashutosh Dutta gave pointers to Public Switched Telephone Network (PSTN) references. Adam Roach suggested improvements related to RFC 6665 and offered other helpful clarifications. Richard Barnes made many suggestions such as referencing the Trust Domain concept of RFCs 3324 and 3325, the use of a separate element for 'tel' URI grouping, and addressing the "redirect" action security threat. 10. References 10.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2141] Moats, R., "URN Syntax", RFC 2141, May 1997. [RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML Media Types", RFC 3023, January 2001. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, January 2004. [RFC3966] Schulzrinne, H., "The tel URI for Telephone Numbers", RFC 3966, December 2004. Shen, et al. Standards Track [Page 27] RFC 7200 SIP Load-Control Event Package April 2014 [RFC4745] Schulzrinne, H., Tschofenig, H., Morris, J., Cuellar, J., Polk, J., and J. Rosenberg, "Common Policy: A Document Format for Expressing Privacy Preferences", RFC 4745, February 2007. [RFC6665] Roach, A., "SIP-Specific Event Notification", RFC 6665, July 2012. [RFC6838] Freed, N., Klensin, J., and T. Hansen, "Media Type Specifications and Registration Procedures", BCP 13, RFC 6838, January 2013. 10.2. Informative References [E.300SerSup3] ITU-T, "North American Precise Audible Tone Plan", Recommendation E.300 Series Supplement 3, November 1988. [E.412] ITU-T, "Network Management Controls", Recommendation E.412-2003, January 2003. [Q.1248.2] ITU-T, "Interface Recommendation for Intelligent Network Capability Set4:SCF-SSF interface", Recommendation Q.1248.2, July 2001. [RFC2648] Moats, R., "A URN Namespace for IETF Documents", RFC 2648, August 1999. [RFC3324] Watson, M., "Short Term Requirements for Network Asserted Identity", RFC 3324, November 2002. [RFC3325] Jennings, C., Peterson, J., and M. Watson, "Private Extensions to the Session Initiation Protocol (SIP) for Asserted Identity within Trusted Networks", RFC 3325, November 2002. [RFC4412] Schulzrinne, H. and J. Polk, "Communications Resource Priority for the Session Initiation Protocol (SIP)", RFC 4412, February 2006. [RFC4825] Rosenberg, J., "The Extensible Markup Language (XML) Configuration Access Protocol (XCAP)", RFC 4825, May 2007. [RFC5031] Schulzrinne, H., "A Uniform Resource Name (URN) for Emergency and Other Well-Known Services", RFC 5031, January 2008. Shen, et al. Standards Track [Page 28] RFC 7200 SIP Load-Control Event Package April 2014 [RFC5390] Rosenberg, J., "Requirements for Management of Overload in the Session Initiation Protocol", RFC 5390, December 2008. [RFC6357] Hilt, V., Noel, E., Shen, C., and A. Abdelal, "Design Considerations for Session Initiation Protocol (SIP) Overload Control", RFC 6357, August 2011. [SIP-OVERLOAD] Gurbani, V., Ed., Hilt, V., and H. Schulzrinne, "Session Initiation Protocol (SIP) Overload Control", Work in Progress, March 2014. Shen, et al. Standards Track [Page 29] RFC 7200 SIP Load-Control Event Package April 2014 Appendix A. Definitions This specification reuses the definitions for "Event Package", "Notification", "Notifier", "Subscriber", and "Subscription" as in [RFC6665]. The following additional definitions are also used. Load Filtering: A load-control mechanism that applies specific actions to selected loads (e.g., SIP requests) matching specific conditions. Load-Filtering Policy: A set of zero or more load-filtering rules, also known as load-filtering rule set. Load-Filtering Rule: Conditions and actions to be applied for load filtering. Load-Filtering Condition: Elements that describe how to select loads to apply load-filtering actions. This specification defines the, , , and condition elements (Section 5.3). Load-Filtering Action: An operation to be taken by a load-filtering server on loads that match the load-filtering conditions. This specification allows actions such as accept, reject, and redirect of loads (Section 5.4). Load-Filtering Server: A server that performs load filtering. In the context of this specification, the load-filtering server is the subscriber, which receives load-filtering policies from the notifier and enforces those policies during load filtering. Load-Control Document: An XML document that describes the load- filtering policies (Section 5). It inherits and enhances the common policy document defined in [RFC4745]. Appendix B. Design Requirements The SIP load-filtering mechanism needs to satisfy the following requirements: o For simplicity, the solution should focus on a method for controlling SIP load, rather than a generic application-layer mechanism. o The load-filtering policy needs to be distributed efficiently to possibly a large subset of all SIP elements. Shen, et al. Standards Track [Page 30] RFC 7200 SIP Load-Control Event Package April 2014 o The solution should reuse existing SIP protocol mechanisms to reduce implementation and deployment complexity. o For predictable overload situations, such as holidays and mass calling events, the load-filtering policy should specify during what time it is to be applied, so that the information can be distributed ahead of time. o For destination-specific overload situations, the load-filtering policy should be able to describe the destination domain or the callee. o To address accidental and intentional high-volume call generators, the load-filtering policy should be able to specify the caller. o Caller and callee need to be specified as both SIP URIs and 'tel' URIs [RFC3966] in load-filtering policies. o It should be possible to specify particular information in the SIP headers (e.g., prefixes in telephone numbers) that allow load filtering over limited regionally focused overloads. o The solution should draw upon experiences from related PSTN mechanisms [Q.1248.2] [E.412] [E.300SerSup3] where applicable. o The solution should be extensible to meet future needs. Appendix C. Discussion of How This Specification Meets the Requirements of RFC 5390 This section evaluates whether the load-control event package mechanism defined in this specification satisfies various SIP overload control requirements set forth by [RFC5390]. As mentioned in Section 1, this specification complements other efforts in the overall SIP load-control solution space. Therefore, not all RFC 5390 requirements are found applicable to this specification. This specification categorizes the assessment results into Yes (the requirement is met), P/A (Partially Applicable), No (must be used in conjunction with another mechanism to meet the requirement), and N/A (Not Applicable). REQ 1: The overload mechanism shall strive to maintain the overall useful throughput (taking into consideration the quality-of- service needs of the using applications) of a SIP server at reasonable levels, even when the incoming load on the network is far in excess of its capacity. The overall throughput under load is the ultimate measure of the value of an overload control mechanism. Shen, et al. Standards Track [Page 31] RFC 7200 SIP Load-Control Event Package April 2014 P/A. The goal of load filtering is to prevent overload or maintain overall goodput during the time of overload, but it is dependent on the predictions of the load and the computations as well as distribution of the filtering policies. If the load predictions or filtering policy computations are incorrect, or the filtering policy is not properly distributed, the mechanism will be less effective. On the other hand, if the load can be accurately predicted and filtering policies be computed and distributed appropriately, this requirement can be met. REQ 2: When a single network element fails, goes into overload, or suffers from reduced processing capacity, the mechanism should strive to limit the impact of this on other elements in the network. This helps to prevent a small-scale failure from becoming a widespread outage. N/A if load-filtering policies are installed in advance and do not change during the potential overload period, P/A if load-filtering policies are dynamically adjusted. The algorithm to dynamically compute load-filtering policies is outside the scope of this specification, while the distribution of the updated filtering policies uses the event package mechanism of this specification. REQ 3: The mechanism should seek to minimize the amount of configuration required in order to work. For example, it is better to avoid needing to configure a server with its SIP message throughput, as these kinds of quantities are hard to determine. No. This mechanism is entirely dependent on advance configuration, based on advance knowledge. In order to satisfy REQ 3, it should be used in conjunction with other mechanisms that are not based on advance configuration. REQ 4: The mechanism must be capable of dealing with elements that do not support it, so that a network can consist of a mix of elements that do and don't support it. In other words, the mechanism should not work only in environments where all elements support it. It is reasonable to assume that it works better in such environments, of course. Ideally, there should be incremental improvements in overall network throughput as increasing numbers of elements in the network support the mechanism. No. This mechanism is entirely dependent on the participation of all possible neighbors. In order to satisfy REQ 4, it should be used in conjunction with other mechanisms, some of which are described in Section 3.4. Shen, et al. Standards Track [Page 32] RFC 7200 SIP Load-Control Event Package April 2014 REQ 5: The mechanism should not assume that it will only be deployed in environments with completely trusted elements. It should seek to operate as effectively as possible in environments where other elements are malicious; this includes preventing malicious elements from obtaining more than a fair share of service. No. This mechanism is entirely dependent on the non-malicious participation of all possible neighbors. In order to satisfy REQ 5, it should be used in conjunction with other mechanisms, some of which are described in Section 3.4. REQ 6: When overload is signaled by means of a specific message, the message must clearly indicate that it is being sent because of overload, as opposed to other, non overload-based failure conditions. This requirement is meant to avoid some of the problems that have arisen from the reuse of the 503 response code for multiple purposes. Of course, overload is also signaled by lack of response to requests. This requirement applies only to explicit overload signals. N/A. This mechanism signals anticipated overload, not actual overload. However, the signals in this mechanism are not used for any other purpose. REQ 7: The mechanism shall provide a way for an element to throttle the amount of traffic it receives from an upstream element. This throttling shall be graded so that it is not all- or-nothing as with the current 503 mechanism. This recognizes the fact that "overload" is not a binary state and that there are degrees of overload. Yes. This event package allows rate-/loss-/window-based overload control options as discussed in Section 5.4. REQ 8: The mechanism shall ensure that, when a request was not processed successfully due to overload (or failure) of a downstream element, the request will not be retried on another element that is also overloaded or whose status is unknown. This requirement derives from REQ 1. N/A to the load-control event package mechanism itself. REQ 9: That a request has been rejected from an overloaded element shall not unduly restrict the ability of that request to be submitted to and processed by an element that is not overloaded. This requirement derives from REQ 1. Shen, et al. Standards Track [Page 33] RFC 7200 SIP Load-Control Event Package April 2014 Yes. For example, load-filtering policy (Section 3.1) can include alternative forwarding destinations for rejected requests. REQ 10: The mechanism should support servers that receive requests from a large number of different upstream elements, where the set of upstream elements is not enumerable. No. Because this mechanism requires advance configuration of specifically identified neighbors, it does not support environments where the number and identity of the upstream neighbors are not known in advance. In order to satisfy REQ 10, it should be used in conjunction with other mechanisms. REQ 11: The mechanism should support servers that receive requests from a finite set of upstream elements, where the set of upstream elements is enumerable. Yes. See also answer to REQ 10. REQ 12: The mechanism should work between servers in different domains. Yes. The load-control event package mechanism is not limited by domain boundaries. However, it is likely more applicable in intra- domain scenarios than in inter-domain scenarios due to security and other concerns (see also Section 3.4). REQ 13: The mechanism must not dictate a specific algorithm for prioritizing the processing of work within a proxy during times of overload. It must permit a proxy to prioritize requests based on any local policy, so that certain ones (such as a call for emergency services or a call with a specific value of the Resource-Priority header field [RFC4412]) are given preferential treatment, such as not being dropped, being given additional retransmission, or being processed ahead of others. P/A. This mechanism does not specifically address the prioritizing of work during times of overload. But it does not preclude any particular local policy. REQ 14: The mechanism should provide unambiguous directions to clients on when they should retry a request and when they should not. This especially applies to TCP connection establishment and SIP registrations, in order to mitigate against avalanche restart. N/A to the load-control event package mechanism itself. Shen, et al. Standards Track [Page 34] RFC 7200 SIP Load-Control Event Package April 2014 REQ 15: In cases where a network element fails, is so overloaded that it cannot process messages, or cannot communicate due to a network failure or network partition, it will not be able to provide explicit indications of the nature of the failure or its levels of congestion. The mechanism must properly function in these cases. P/A. Because the load-filtering policies are provisioned in advance, they are not affected by the overload or failure of other network elements. On the other hand, they may not, in those cases, be able to protect the overloaded network elements (see REQ 1). REQ 16: The mechanism should attempt to minimize the overhead of the overload control messaging. Yes. The standardized SIP event package mechanism [RFC6665] is used. REQ 17: The overload mechanism must not provide an avenue for malicious attack, including DoS and DDoS attacks. P/A. This mechanism does provide a potential avenue for malicious attacks. Therefore, the security mechanisms for SIP event packages, in general, [RFC6665] and Section 7 of this specification should be used. REQ 18: The overload mechanism should be unambiguous about whether a load indication applies to a specific IP address, host, or URI, so that an upstream element can determine the load of the entity to which a request is to be sent. Yes. The identity of load indication is covered in the load- filtering policy format definition in Section 3.1. REQ 19: The specification for the overload mechanism should give guidance on which message types might be desirable to process over others during times of overload, based on SIP-specific considerations. For example, it may be more beneficial to process a SUBSCRIBE refresh with Expires of zero than a SUBSCRIBE refresh with a non-zero expiration (since the former reduces the overall amount of load on the element), or to process re-INVITEs over new INVITEs. N/A to the load-control event package mechanism itself. REQ 20: In a mixed environment of elements that do and do not implement the overload mechanism, no disproportionate benefit shall accrue to the users or operators of the elements that do not implement the mechanism. Shen, et al. Standards Track [Page 35] RFC 7200 SIP Load-Control Event Package April 2014 No. This mechanism is entirely dependent on the participation of all possible neighbors. In order to satisfy REQ 20, it should be used in conjunction with other mechanisms, some of which are described in Section 3.4. REQ 21: The overload mechanism should ensure that the system remains stable. When the offered load drops from above the overall capacity of the network to below the overall capacity, the throughput should stabilize and become equal to the offered load. N/A to the load-control event package mechanism itself. REQ 22: It must be possible to disable the reporting of load information towards upstream targets based on the identity of those targets. This allows a domain administrator who considers the load of their elements to be sensitive information, to restrict access to that information. Of course, in such cases, there is no expectation that the overload mechanism itself will help prevent overload from that upstream target. N/A to the load-control event package mechanism itself. REQ 23: It must be possible for the overload mechanism to work in cases where there is a load balancer in front of a farm of proxies. Yes. The load-control event package mechanism does not preclude its use in a scenario with server farms. Appendix D. Complete Examples D.1. Load-Control Document Examples This section presents two complete examples of load-control documents valid with respect to the XML schema defined in Section 6. The first example assumes that a set of hotlines are set up at "sip:alice@hotline.example.com" and "tel:+1-212-555-1234". The hotlines are activated from 12:00 to 15:00 US Eastern Standard Time on 2008-05-31. The goal is to limit the incoming calls to the hotlines to 100 requests per second. Calls that exceed the rate limit are explicitly rejected. Shen, et al. Standards Track [Page 36] RFC 7200 SIP Load-Control Event Package April 2014 INVITE 2008-05-31T12:00:00-05:00 2008-05-31T15:00:00-05:00 100 The second example optimizes the usage of server resources during the three-day period following a hurricane. Incoming calls to the domain "sandy.example.com" or to call destinations with prefix "+1-212" will be limited to a rate of 100 requests per second, except for those calls originating from a particular rescue team domain "rescue.example.com". Outgoing calls from the hurricane domain or calls within the local domain are never limited. All calls that are throttled due to the rate limit will be forwarded to an answering machine with updated hurricane rescue information. Shen, et al. Standards Track [Page 37] RFC 7200 SIP Load-Control Event Package April 2014 INVITE 2012-10-25T09:00:00+01:00 2012-10-28T09:00:00+01:00 100 Sometimes it may occur that multiple rules in a ruleset define actions that match the same methods, call identity and validity. In those cases, the "first-match-wins" principle is used. For example, in the following ruleset, the first rule requires all calls from the "example.com" domain to be rejected. Even though the rule following that one specifies that calls from "sip:alice@example.com" be redirected to a specific target "sip:eve@example.com", the calls from "sip:alice@example.com" will still be rejected because they have already been matched by the earlier rule. Shen, et al. Standards Track [Page 38] RFC 7200 SIP Load-Control Event Package April 2014 INVITE 2013-7-2T09:00:00+01:00 2013-7-3T09:00:00+01:00 0 INVITE 2013-7-2T09:00:00+01:00 2013-7-3T09:00:00+01:00 0 Shen, et al. Standards Track [Page 39] RFC 7200 SIP Load-Control Event Package April 2014 D.2. Message Flow Examples This section presents an example message flow of using the load- control event package mechanism defined in this specification. atlanta biloxi | F1 SUBSCRIBE | |------------------>| | F2 200 OK | |<------------------| | F3 NOTIFY | |<------------------| | F4 200 OK | |------------------>| F1 SUBSCRIBE atlanta.example.com -> biloxi.example.com SUBSCRIBE sip:biloxi.example.com SIP/2.0 Via: SIP/2.0/TCP atlanta.example.com;branch=z9hG4bKy7cjbu3 From: sip:atlanta.example.com;tag=162ab5 To: sip:biloxi.example.com Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com CSeq: 2012 SUBSCRIBE Contact: sip:atlanta.example.com Event: load-control Max-Forwards: 70 Accept: application/load-control+xml Expires: 3600 Content-Length: 0 F2 200 OK biloxi.example.com -> atlanta.example.com SIP/2.0 200 OK Via: SIP/2.0/TCP biloxi.example.com;branch=z9hG4bKy7cjbu3 ;received=192.0.2.1 To: ;tag=331dc8 From: ;tag=162ab5 Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com CSeq: 2012 SUBSCRIBE Expires: 3600 Contact: sip:biloxi.example.com Content-Length: 0 Shen, et al. Standards Track [Page 40] RFC 7200 SIP Load-Control Event Package April 2014 F3 NOTIFY biloxi.example.com -> atlanta.example.com NOTIFY sip:atlanta.example.com SIP/2.0 Via: SIP/2.0/TCP biloxi.example.com;branch=z9hG4bKy71g2ks From: ;tag=331dc8 To: ;tag=162ab5 Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com Event: load-control Subscription-State: active;expires=3599 Max-Forwards: 70 CSeq: 1775 NOTIFY Contact: sip:biloxi.example.com Content-Type: application/load-control+xml Content-Length: ... [Load-Control Document] F4 200 OK atlanta.example.com -> biloxi.example.com SIP/2.0 200 OK Via: SIP/2.0/TCP atlanta.example.com;branch=z9hG4bKy71g2ks ;received=192.0.2.2 From: ;tag=331dc8 To: ;tag=162ab5 Call-ID: 2xTb9vxSit55XU7p8@atlanta.example.com CSeq: 1775 NOTIFY Content-Length: 0 Appendix E. Related Work E.1. Relationship to Load Filtering in PSTN It is known that an existing PSTN network also uses a load-filtering mechanism to prevent overload and the filtering policy configuration is done manually except in specific cases when the Intelligent Network architecture is used [Q.1248.2][E.412]. This specification defines a load-filtering mechanism based on the SIP event notification framework that allows automated filtering policy distribution in suitable environments. PSTN overload control uses messages that specify an outgoing control list, call gap duration, and control duration [Q.1248.2][E.412]. These items correspond roughly to the identity, action, and time fields of the SIP load-filtering policy defined in this specification. However, the load-filtering policy defined in this specification is much more generic and flexible as opposed to its PSTN counterpart. Shen, et al. Standards Track [Page 41] RFC 7200 SIP Load-Control Event Package April 2014 Firstly, PSTN load filtering only applies to telephone numbers. The identity element of SIP load-filtering policy allows both SIP URI and telephone numbers (through 'tel' URI) to be specified. These identities can be arbitrarily grouped by SIP domains or any number of leading prefixes of the telephone numbers. Secondly, the PSTN load-filtering action is usually limited to call gapping. The action field in SIP load-filtering policy allows more flexible possibilities such as rate throttle and others. Thirdly, the duration field in PSTN load filtering specifies a value in seconds for the load-filtering duration only, and the allowed values are mapped into a value set. The time field in SIP load- filtering policy may specify not only a duration, but also a future activation time that could be especially useful for automating load filtering for predictable overloads. PSTN load filtering can be performed in both edge switches and transit switches; the SIP load filtering can also be applied in both edge proxy servers and core proxy servers, and even in capable user agents. PSTN load filtering also has special accommodation for High Probability of Completion (HPC) calls, which would be similar to calls designated by the SIP Resource Priority Headers [RFC4412]. The SIP load-filtering mechanism also allows prioritizing the treatment of these calls by specifying favorable actions for them. PSTN load filtering also provides an administrative option for routing failed call attempts to either a reorder tone [E.300SerSup3] indicating overload conditions or a special recorded announcement. A similar capability can be provided in the SIP load-filtering mechanism by specifying appropriate "alt-action" attribute in the SIP load-filtering action field. E.2. Relationship with Other IETF SIP Overload Control Efforts The load-filtering policies in this specification consist of identity, action, and time. The identity can range from a single specific user to an arbitrary user aggregate, domains, or areas. The user can be identified by either the source or the destination. When the user is identified by the source and a favorable action is specified, the result is, to some extent, similar to identifying a priority user based on authorized Resource Priority Headers [RFC4412] in the requests. Specifying a source user identity with an unfavorable action would cause an effect to some extent similar to an inverse SIP resource priority mechanism. Shen, et al. Standards Track [Page 42] RFC 7200 SIP Load-Control Event Package April 2014 The load-filtering policy defined in this specification is generic and expected to be applicable not only to the load-filtering mechanism but also to the feedback overload control mechanism in [SIP-OVERLOAD]. In particular, both mechanisms could use specific or wildcard identities for load control and could share well-known load- control actions. The time duration field in the load-filtering policy could also be used in both mechanisms. As mentioned in Section 1, the load-filtering policy distribution mechanism and the feedback overload control mechanism address complementary areas in the overload control problem space. Load filtering is more proactive and focuses on distributing filtering policies towards the source of the traffic; the hop-by-hop feedback-based approach is reactive and reduces traffic already accepted by the network. Therefore, they could also make different use of the generic load-filtering policy components. For example, the load-filtering mechanism may use the time field in the filtering policy to specify not only a control duration but also a future activation time to accommodate a predicable overload such as the one caused by Mother's Day greetings or a viewer-voting program; the feedback-based control might not need to use the time field or might use the time field to specify an immediate load-control duration. Shen, et al. Standards Track [Page 43] RFC 7200 SIP Load-Control Event Package April 2014 Authors' Addresses Charles Shen Columbia University Department of Computer Science 1214 Amsterdam Avenue, MC 0401 New York, NY 10027 USA Phone: +1 212 854 3109 EMail: charles@cs.columbia.edu Henning Schulzrinne Columbia University Department of Computer Science 1214 Amsterdam Avenue, MC 0401 New York, NY 10027 USA Phone: +1 212 939 7004 EMail: schulzrinne@cs.columbia.edu Arata Koike NTT Network Technology Labs 3-9-11 Midori-cho Musashino-shi Tokyo 180-8585 Japan Phone: +81 422 59 6099 EMail: koike.arata@lab.ntt.co.jp Shen, et al. Standards Track [Page 44]/iesg@ietf.org/sip-overload@ietf.org