Description

This article describes the behavior of SRX when many TTL-0/1 ICMP packets come into SRX within a short time.

Symptoms

Normally, when SRX receives ICMP packet with a TTL value of 0 or 1, SRX will drop it as seen in the following flow traceoption log:

Apr  5 17:20:54 17:20:53.973919:CID-0:THREAD_ID-02:RT:  packet dropped,  ttl expiry .

The SRX will also reply with ICMP type 11 code 0 packet to the sender as seen in the following flow traceoption log:

Apr  5 17:20:54 17:20:53.973912:CID-0:THREAD_ID-02:RT: Sending icmp:11, code: 0  

However, when many packets come into SRX within a short time, it can only reply with ICMP type 11 code 0 packets for part of the packets, and not all.

Solution

This is an expected behavior, as the ICMP TTL exceed packet is generated in PFE.

When there are many TTL-0/1 packets coming into SRX such as traffic loop, PFE will be impacted. It has a rate limit for ICMP to protect itself. The default value is 20 packets per 10 seconds.

Example: 

PPS=20, only 21 replied packets received for 100 ICMP request TTL-1 packets.
# hping3 -I ens33 -1 -t 1 -i u50000  40.1.1.2 -d 64 -c 100
HPING 40.1.1.2 (ens33 40.1.1.2): icmp mode set, 28 headers + 64 data bytes
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   
TTL 0 during transit from ip=192.168.4.254 name=UNKNOWN   

--- 40.1.1.2 hping statistic ---
100 packets transmitted, 21 packets received, 79% packet loss <<<