Hi! All but the (0) issue are editorial issues, and the JSON parsing issues ought to be easy to fix: 0) JSON parsing issues: 0.1) s3.1.5: I think maybe instead of this: "attack-description": "attack-description": "DNS amplification Attack: \ ... use this: "attack-description": "DNS amplification Attack: \ ... 0.2) s3.2.2: Error: Duplicate key 'mid-percentile-g' 1) Can you provide some additional background on the term "label" as it is used in this document; appears to be related to ML. See Un/Supervised Machine Learning definitions. 2) s3.1: I think maybe some .md/.xml for the bullets got messed up: In particular, the following telemetry parameters are used: * 'measurement-interval' to define the period during which percentiles are computed. * 'measurement-sample' to define the time distribution for measuring values that are used to compute percentiles. 3) s3.1.1, 1st para: Not sure you need the 1 Tps example, in 5 years that might seem low. Also maybe tweak the sentence a bit: Some transit providers have to mitigate very large-scale DDoS attacks with their own previously deployed DDoS Mitigation Systems (DMSes) that lack sufficient resources. 4) s3.1.1, 2nd para (friendly editorial suggestion): s/The aim of this use case is to enable transit/This use case enables transit 5) Figure 1: Would it be clearer for the target(s) in the figure to be: [ Target(s)] 6) s3.1.1, 4th para: The word "using" is kind of dangling: s/The forwarding nodes send traffic statistics to the flow collectors using, e.g., IP Flow Information Export (IPFIX) [RFC7011]. /The forwarding nodes send traffic statistics to the flow collectors, e.g., using IP Flow Information Export (IPFIX) [RFC7011]. 7) s3.1.1, 4th para: Maybe: After that, the orchestrator orders the forwarding nodes to redirect as much of the top-talker's traffic to the DMS as possible by dissemination of Flow Specifications relying upon tools, such as Border Gateway Protocol Dissemination of Flow Specification Rules (BGP Flowspec) [RFC8955]. NEW: After that, the orchestrator orders the forwarding nodes to redirect as much of the top-talker's traffic to the DMS as possible by dissemination of Flow Specifications using tools such as Border Gateway Protocol Dissemination of Flow Specification Rules (BGP Flowspec) [RFC8955]. 8) s3.1.2, 1st para: Is this: Transit providers can deploy their DMSes in clusters. Then, they can select the DMS to be used to mitigate a DDoS attack under attack time. trying to say this: Transit providers can deploy their DMSes in clusters. Then, they can select the DMS to be used to mitigate a DDoS attack while under attack. 9) s3.1.2, 2nd para: s/The aim of this use case is to enable transit/This use case enables transit 10) Figure 3: Why are there two [Target] elements in the figure? 11) s3.1.2, 3rd para: The word "using" is kind of dangling: s/The forwarding nodes send traffic statistics to the flow collectors using, e.g., IP Flow Information Export (IPFIX) [RFC7011]. /The forwarding nodes send traffic statistics to the flow collectors, e.g., using IP Flow Information Export (IPFIX) [RFC7011]. 12) s3.1.3, 2nd para: s/The aim of this use case is to enable transit/This use case enables transit 13) Figure 5: I think you need one more space before the line with the nodes to make the DOTS box a box :): --->C| Forwarding | --->C| Forwarding |---> e.g., BGP Flowspec | node | | node | ^ add a space (Redirect) --->| | | | DDoS Attack 14) s3.1.3, 3rd para: OLD: After that, the orchestrator orders the appropriate forwarding nodes to redirect the attack traffic to the optimal DMS by dissemination of Flow Specifications relying upon tools, such as BGP Flowspec. NEW: After that, the orchestrator orders the appropriate forwarding nodes to redirect the attack traffic to the optimal DMS by dissemination of Flow Specifications using tools such as Border Gateway Protocol Dissemination of Flow Specification Rules (BGP Flowspec) [RFC8955]. 15) s3.1.4, 1st para: s/internet/Internet s/The feature of the attack is that start from zero and go to maximum /These attacks start from zero and go to maximum s/It is difficult for them to mitigate an attack by DMS by redirecting attack flows because it may cause route flapping in the network. /It is difficult for the transit providers to mitigate an attack with their DMSes by redirecting attack flows because it may cause route flapping in the network. 16) s3.1.4, 2nd para: s/The aim of this use case is to enable transit/This use case enables transit 17) s3.1.4, 3rd para: Maybe: After that, the administrative system orders relevant forwarding nodes to carry out rate-limit all traffic destined to the target based on the pipe capability by the dissemination of the Flow Specifications relying upon tools, such as BGP Flowspec. NEW: After that, the administrative system orders relevant forwarding nodes to carry out rate-limit all traffic destined to the target based on the pipe capability by the dissemination of the Flow Specifications using tools such as Border Gateway Protocol Dissemination of Flow Specification Rules (BGP Flowspec) [RFC8955]. 18) s3.1.5, 1st para: Provide reference for DNS Water Torture Attacks. 19) s3.1.5, 2nd para: s/The aim of this use case is to enable transit/This use case enables transit 20) s3.1.5, 5th para: s/Specifications, e.g. [RFC8955] /Specifications using tools such as Border Gateway Protocol Dissemination of Flow Specification Rules (BGP Flowspec) [RFC8955]. s/such as BGP /such as BGP [RFC4271]. 21) s3.2: s/The aim of this use case is to share the/This use case enables sharing of 22) s3.3.1, 1st para: s/internet/Internet 23) s3.3.1, 2nd para: s/The aim of this use case is to enable transit/This use case enables transit 24) s3.3.2, 1st para: s/The aim of this use case is to carry out/This use case supports