My end customer was investigating an MX304 running 23.4R2-S5 that was not responding to traceroutes (no ICMP ttl expired was being sent).
After plenty of checks I realized that a ddos-protection for TTL was active/violated for 1 month.
Aug 6 01:49:13 JTAC jddosd[22565]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 1 times, started at 2025-08-06 01:49:13 CEST
Aug 6 01:49:14 JTAC jddosd[22565]: %DAEMON-4-DDOS_SCFD_FLOW_FOUND: A new flow of protocol TTL:aggregate on lsi.4 with source addr -- -- -- is found at 2025-08-06 01:49:12 CEST
Aug 6 01:49:17 JTAC jddosd[22565]: %DAEMON-4-DDOS_SCFD_FLOW_FOUND: A new flow of protocol TTL:aggregate on lsi.4 with source addr -- -- -- is found at 2025-08-06 01:49:13 CEST
Aug 6 16:50:04 JTAC jddosd[22565]: %DAEMON-4-DDOS_SCFD_FLOW_FOUND: A new flow of protocol TTL:aggregate on ae1.0 with source addr -- -- -- is found at 2025-08-06 16:50:00 CEST
|
10-Sep-2025
Violation first detected at: 2025-08-06 01:49:13 CEST
Violation last seen at: 2025-08-06 01:49:13 CEST
Duration of violation: 00:00:00 Number of violations: 1
show ddos-protection protocols violations
Packet types: 253, Currently violated: 1
Protocol Packet Bandwidth Arrival Peak Policer bandwidth
group type (pps) rate(pps) rate(pps) violation detected at
ttl aggregate 2000 24 5391 2025-08-06 01:49:13 CEST
Detected on: FPC-0
From logs we can see that the violation is supposed to get cleared within 6 min, when no new flow are detected.
After the 1st flow, we do not see another one till long time. But the flow are getting cleared with logs "cleared due to staleness", which means the violation is stuck.
Sep 10 11:34:49 DDOS_SCFD_FLOW_LOST: A flow of protocol exceptions:mtu-exceeded on xe-a/b/c.501 with source addr w.x.y.z is cleared due to staleness. Found at 2024-09-23 18:54:25 CEST, last observed at 2024-09-23 18:59:23 CEST
Sep 10 11:34:49 DDOS_SCFD_FLOW_LOST: A flow of protocol exceptions:mtu-exceeded on xe-a/b/c.501 with source addr w.x.y.z is cleared due to staleness. Found at 2024-09-23 18:54:24 CEST, last observed at 2024-09-23 18:59:24 CEST
There is one PR with similar issue where violation/flows are stuck for ttl - PR1868600.
This is fixed via PR1860439, with RCA for getting stuck as "Ending conversion of retrieved hash external data is not assigned back".
https://prsearch.juniper.net/problemreport/PR1860439
As per the PR, clearing the flows did not help. But we can try same.
clear ddos-protection protocols ttl states
clear ddos-protection protocols ttl culprit-flows
clear ddos-protection protocols ttl aggregate states