An unusual increase in the "data error" counter was observed while executing the show pfe statistics traffic command.

Identification: Malformed packets were detected from specific source–destination pairs.

Packet Type: All affected packets were DNS responses (port 53) encapsulated over GRE (port 4754).

Issue: Packets were truncated with missing bytes, resulting in corruption flags.

Version Comparison:

• Routers running 22.2R3 did not show data error increments.
• Routers on 23.4R2-S4 and 23.4R2-S5 consistently showed Trap Code 95 increments.

Diagnostics:

• Commands such as parcel_dump.py -p0 -t95 -c5 were executed to capture malformed packets.
• Trapstats counters (e.g., slu.trapcode.v4_total_len) were monitored.

Scope: The increase in malformed packets was confirmed across multiple FPCs.

Release Comparison: A change in Junos behavior was identified between releases 22.2R3 and 23.4R2-S4/S5-EVO.

Trapcode Field: The field slu.trapcode.v4_total_len does not exist in version 22.2R3. It was introduced starting from version 23.3 as part of PR-1730887.

Packet Handling: Malformed packets are confirmed to be discarded in 22.2R3 Junos, even though there are no trapcodes or data error fields present.