This Knowledge Base article outlines how to effectively monitor and analyze exception traffic, such as packets with a Time-To-Live (TTL) of 1 or those encountering "no route" scenarios, using the DDoS protection mechanism available on Juniper Junos platforms.

Understanding Junos DDoS Protection

The DDoS protection mechanism in Junos is designed to safeguard the Routing Engine (RE) from excessive traffic that could overwhelm its control plane. It achieves this by automatically creating and applying policers (which can also be configured manually). The primary function is to rate-limit traffic destined for the RE, thereby ensuring the stability and availability of the control plane.

CLI Commands for Monitoring DDoS Protection

To inspect the DDoS protection statistics and protocol-specific details, you can use the following CLI commands:

• show ddos-protection statistics
• show ddos-protection protocols

Monitoring TTL-Related Drops

Packets with a TTL of 1 are typically dropped by the next-hop router to prevent routing loops. However, if a large volume of such packets reaches the RE, it can indicate a potential issue. Junos DDoS protection can help monitor this.

Use the following command to specifically check for TTL traffic:

show ddos-protection protocols ttl

Example Output:

root@spine4> show ddos-protection protocols ttl 
Packet types: 1, Modified: 0, Received traffic: 0, Currently violated: 0
Currently tracked flows: 0, Total detected flows: 0
* = User configured value

Protocol Group: TTL

  Packet type: aggregate (Aggregate for all ttl traffic)
   Aggregate policer configuration:
     Bandwidth:    50 pps
     Burst:      10 packets 
     Priority:     Low 
     Recover time:   300 seconds 
     Enabled:      Partial
   System-wide information:
     Aggregate bandwidth is never violated
     Received: 0          Arrival rate:    0 pps
     Dropped:  0          Max arrival rate: 0 pps

The Arrival rate field in this output is crucial. It indicates the number of packets per second arriving on the switch with a TTL of 1. A consistently high arrival rate can signify an underlying network problem or malicious activity.

Monitoring L3 Destination Miss Related Drops

Similarly, l3dest-miss refers to packets for which the router does not have a valid route in its forwarding table. These packets are typically punted to the Routing Engine for further processing or dropping.

You can monitor traffic related to L3 destination misses using a similar ddos-protection protocols command (the exact packet type might vary slightly depending on Junos version, but l3dest-miss is common):

show ddos-protection protocols l3dest-miss

Just like with TTL, the Arrival rate for l3dest-miss is key. If this rate is high, it indicates a significant amount of traffic arriving for destinations that are unreachable or unknown to the router. A high arrival rate will lead to ddos-violation logs in the system messages, and any traffic exceeding the defined rates will be dropped by the DDoS protection policers.

Streaming Telemetry for DDoS Protection

For advanced, real-time monitoring and integration with network monitoring systems, Junos provides streaming telemetry sensors. The sensor for exposing DDoS protection data is:

• /junos/system/linecard/ddos

This sensor allows you to stream detailed DDoS protection statistics directly from the line card, providing granular insights into exception traffic behavior.