In this article, we explain a scenario where multiple protocols experienced flaps without any apparent trigger or identified root cause. The issue was ultimately traced back to DDoS protection being disabled, combined with a high rate of hostbound traffic overwhelming the control plane. We highlight why disabling DDoS protections is not recommended, as it exposes the system to instability and congestion risks.

• The protocols are flapping without any relevant entries in the system logs or traceoptions.
• The only explanatory logs observed correlate the issue to packet loss between neighbor sessions during protocol keepalive exchanges.
• In addition, a high rate of hostbound traffic is overwhelming the control plane.
• DDoS protections disabled in the configuration, which is contributing to the instability.

Multiple protocols flapping due to the following configuration:
 

 ddos-protection {
  global {
   disable-fpc;
   disable-logging;
  }

This will cause a instability in the system and might cause crashes. When you disable DDoS protection, rate limiting is disabled for all host-bound traffic. By doing so, you are allowing all control traffic to be punted to the host path at a high rate, which eventually will hog the CPU which could cause drops. It is documented in the below article. This is not a recommended practice: https://supportportal.juniper.net/s/article/EX-QFX-FPC-vulnerability-after-DDoS-Protection-is-disabled?language=en_US 

Without DDOs, high rate of CPU bound packets are received as bandwidth for all CPU queues will be set to 100000pps.