This KB describes the details about the DNS related traffic issue after updating the IDP signature database. 

These are the symptoms of the issue:  

>> DNS related traffic is affected after the IDP sigDB update to 3817.

>> If the IDP service is removed from the security policy or DNS related rule is removed from IDP, then DNS will start working. 

>> In the output for the command,  "show security idp attack table",  the counters increment for the drops on DNS:ISC-BIND-PACKAGE-DOS.

user@router> show security idp attack table | no-more
IDP attack statistics:
DNS:ISC-BIND-PACKAGE-DOS                     890
——
IDP attack statistics:
DNS:ISC-BIND-PACKAGE-DOS                     898
——
IDP attack statistics:
DNS:ISC-BIND-PACKAGE-DOS                     906

>> In the output of "monitor security packet drop" command, the packets get dropped due to the below error:
user@router> monitor security packet drops destination-port 53 
user@router> 10:29:50.950523:LSYS-ID-00 8.8.8.8/53-->10.10.10.30/39304;udp,ipid-41752,reth1.0,Dropped by FLOW:flow drop discarded by jsf plugin junos-idp

This is a known issue in which DNS related IDP traffic is getting dropped after the IDP sigDB update to 3817.

The fix for this issue is to update the IDP sigDB to the version 3818 or above, in which the necessary changes are added. 

2025-06-23 : Article Created