This knowledge base article describes the DNS-related traffic issue that occurs after updating the IDP signature database.

The symptoms of the issue are as follows:

>> DNS-related traffic is affected after updating the IDP sigDB to 3817.

>> DNS functionality resumes when the IDP service is removed from the security policy or the DNS-related rule is removed from IDP.

>> The output of the "show security idp attack table" command shows incrementing counters for DNS:ISC-BIND-PACKAGE-DOS drops.

user@router> show security idp attack table | no-more
IDP attack statistics:
DNS:ISC-BIND-PACKAGE-DOS                     890
——
IDP attack statistics:
DNS:ISC-BIND-PACKAGE-DOS                     898
——
IDP attack statistics:
DNS:ISC-BIND-PACKAGE-DOS                     906

>> In the output of "monitor security packet drop" command, the packets get dropped due to the below error:
user@router> monitor security packet drops destination-port 53 
user@router> 10:29:50.950523:LSYS-ID-00 8.8.8.8/53-->10.10.10.30/39304;udp,ipid-41752,reth1.0,Dropped by FLOW:flow drop discarded by jsf plugin junos-idp

This is a known issue where DNS-related IDP traffic is dropped after updating the IDP sigDB to version 3817.

The fix for this issue is to update the IDP sigDB to version 3818 or later, which includes the necessary changes.

2025-06-23 : Article Created