Description

Junos may report a MARTIAN-address host-bound DDoS violation when ICMP Type 3 Code 4 (Fragmentation Needed) packets are sent to the switch CPU with an invalid source address, commonly 0.0.0.0.

In the reviewed case, packet captures showed that packets exceeded the effective MTU after tunnel encapsulation. The tunnel device (Mist-Edge) generated ICMP Fragmentation Needed messages with a reported MTU of 1446, while the Juniper core-facing Ethernet link remained at MTU 1500 and showed no physical errors or drops. The invalid ICMP source address caused the messages to be classified as MARTIAN traffic and sent to the host-bound CPU queue.


Key finding: The Juniper switches were detecting and protecting the CPU from malformed or unexpected control traffic. The evidence did not indicate a physical interface problem or a sustained DDoS attack.

Symptoms

  • Repeated syslog messages for MARTIAN-address:aggregate, usually during short bursts above the configured host-bound policer rate.

DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception MARTIAN-address:aggregate exceeded its allowed bandwidth at fpc 0 for <count> times, started at <timestamp> UTC

 

  • The DDoS statistics show a current or historical violation, but packet drops remain at zero and the Routing Engine policer is not violated.
  • The host-bound capture shows ICMP Type 3 Code 4 packets with source IP 0.0.0.0 and a lower reported MTU, such as 1446.
  • The source MAC is learned behind an aggregated Ethernet interface connected to a tunnel or edge device.
  • The Juniper core-facing interface remains up with the expected MTU and no CRC, framing, resource, or physical drops.

Solution

  • 1-- Confirm the violation and impact

show log messages | match DDOS_PROTOCOL_VIOLATION

show ddos-protection protocols martian-address statistics detail | no-more

 

Confirm the affected FPC, the configured bandwidth and burst, the maximum arrival rate, and whether packets or Routing Engine traffic were dropped.

 

  • 2-- Capture the host-bound traffic
On an EX4400, the BRCM_PKT trace handle used for this capture is platform-specific. In the reviewed case, handle 15 was used on FPC 0 and CPU queue 25 was monitored.
 
 
start shell
cprod -A fpc0 -c "show ukern_trace handles" <<< to find the BRCM_PKT ID
 
 
cprod -A fpc0 -c "undebug halp-pkt rx"
cprod -A fpc0 -c "set ukern_trace 15 buffer 104857600"
cprod -A fpc0 -c "debug halp-pkt rx pkt-capture-size 2000"
cprod -A fpc0 -c "debug halp-pkt rx cpuQ 25"
 
 
3. Save a trace automatically when the violation occurs
 
Return to the Junos CLI and configure an event policy that saves the trace when a new MARTIAN-address:aggregate violation is detected.
 
cli
configure
set event-options policy DDOS-MARTIAN-WDS events ddos_protocol_violation_set
set event-options policy DDOS-MARTIAN-WDS attributes-match ddos_protocol_violation_set.protocol-name matches MARTIAN-address:aggregate
set event-options policy DDOS-MARTIAN-WDS then execute-commands commands "request routing-engine execute local command \"cprod -A fpc0 -c 'show ukern_trace 15' > /var/tmp/MARTIAN_WDS_ukern_trace.txt\""
commit
 
The file is created only after a new violation occurs. Copy and rename the file after each event because a later event can overwrite the same filename.

 

 

  • 3-- Review the capture findings

The capture showed ICMP Type 3 Code 4 packets with source IP 0.0.0.0 and a reported MTU of 1446. The traffic was associated with the tunnel or edge device, while the Juniper core-facing link remained healthy with MTU 1500 and no physical errors or drops.

 

  • 4-- Apply the wireless-side recommendation

A tech case with the Wireless-Assurance team was opened since the traffic triggering the DDOS alerts was coming from a Mist-Edge device, they suggested reviewing the Mist Edge tunnel configuration and aligning the effective MTU after L2TP encapsulation. They also suggested using the actual client/source IP instead of 0.0.0.0 when generating ICMP Type 3 Code 4 messages, if supported by the tunnel platform.

After the change, monitor the tunnel device and the Juniper switches to confirm that the MARTIAN-address violations stop or are significantly reduced.

Modification History

2026-08-18 : Article Created