Original text:
classification. Note that the use of a connection ID to support connection migration <del> renders 5-tuple based filtering insufficient and requires more state to be maintained by DDoS defense systems.  For the common case of NAT rebinding, where the client's address changes without the client's intent or knowledge, DDoS defense systems can detect a change in the client's endpoint address by linking flows based on the server's connection IDs.  However, QUIC's linkability resistance ensures that a deliberate connection migration is accompanied by a change in the connection ID.  In this case, the connection ID can not be used to distinguish valid, active traffic from new attack traffic. </del>  It is also possible for endpoints to directly support security functions such as DoS classification and mitigation.  Endpoints can learning instead of processing observed header information. However, it is questionable whether connection migrations must be <del> supported during a DDoS attack.  However, for unintentional mitigations, as is usually the case for NAT rebindings, the connection ID can be used to track connections (see sec-flow- association).  If the connection migration is not visible to the network that performs the DDoS detection, an active, migrated QUIC connection may be blocked by such a system under attack.  As soon as the connection blocking is detected by the client, the client may rely on the fast resumption mechanism provided by QUIC.  When clients migrate to a new path, they should be prepared for the migration to fail and attempt to reconnect quickly. </del>  Beyond in-network DDoS protection mechanisms, TCP syncookies RFC4937 are a well-established method of mitigating some kinds of TCP DDoS

Reviewer comments:
We recently added this sentence but the text two paragraphs up already says this. Here is my proposed change, however, maybe we can shorten this paragraph even further.

Revised text:
classification. Note that the use of a connection ID to support connection migration  <ins> renders 5-tuple based filtering insufficient to detect active flows and requires more state to be maintained by DDoS defense systems if support of migration of QUIC flows is desired.  For the common case of NAT rebinding, where the client's address changes without the client's intent or knowledge, DDoS defense systems can detect a change in the client's endpoint address by linking flows based on the server's connection IDs.  However, QUIC's linkability resistance ensures that a deliberate connection migration is accompanied by a change in the connection ID.  In this case, the connection ID can not be used to distinguish valid, active traffic from new attack traffic. </ins> It is also possible for endpoints to directly support security functions such as DoS classification and mitigation.  Endpoints can learning instead of processing observed header information. However, it is questionable whether connection migrations must be  <ins> supported during a DDoS attack.  While unintended migration without a connection ID change can be more easily supported, it might be acceptable to not support migrations of active QUIC connections that are not visible to the network functions performing the DDoS detection.  As soon as the connection blocking is detected by the client, the client may be able to rely on the fast resumption mechanism provided by QUIC.  When clients migrate to a new path, they should be prepared for the migration to fail and attempt to reconnect quickly. </ins> Beyond in-network DDoS protection mechanisms, TCP syncookies RFC4937 are a well-established method of mitigating some kinds of TCP DDoS