Description

How to Identify the source of packets exceeding DDoS?

Symptoms

Logs reports frequent DDoS violations.

 

<Timestamp hostname> jddosd 11122 DDOS_PROTOCOL_VIOLATION_SET [[email protected] protocol-name="DHCPv4v6:aggregate" source-name="fpc 0" repeat-count="7" time-first-detected="2023-06-15 08:11:01 EDT"] Warning: Host-bound traffic for protocol/exception DHCPv4v6:aggregate exceeded its allowed bandwidth at fpc 0 for 7 times, started at 2023-06-15 08:11:01 EDT

 

 

Solution

Check if the traffic rate is exceeding the thresholds or if the protocol is violated.

 

show ddos-protection protocols statistics terse | match viol | refresh 1

 

 

If the traffic rate is frequently exceeded, collect a pcap of the traffic going to the RE to identify the source or sources generating the packets when DDoS is violated.

 

monitor traffic interface irb no-resolve size 1500 layer2-headers write-file /var/tmp/capture.pcap >>> use ctrl + c to stop it.

 

 

 

Modification History

2023/06/22 -Creation date

2025/09/09 -Added EX4600 to categories.