The article introduces a scenario why there is Rejectv6 DDOS Violation before BGP ipv6 peer down.For ipv4 , the nh will become hold if arp expired ;For ipv6 , the nh will become reject if peer unreachable .
<< The loopback address is reachable via static route.
[EBGP RouterA] --- [EBGP RouterB] R1 loopback: 2001:db8:1:255::1/128 R2 loopback: 2001:db8:1:255::2/128
<< Rejectv6 DDOS Violation was set on all FPCs before BGPv6 peer down.
Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 4 for 1 times, started at 2023-11-16 13:11:37 CST Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 7 for 1 times, started at 2023-11-16 13:11:37 CST Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 5 for 1 times, started at 2023-11-16 13:11:37 CST Nov 16 13:11:38 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 10 for 1 times, started at 2023-11-16 13:11:37 CST Nov 16 13:11:42 RouterB jddosd[37969]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Rejectv6:aggregate exceeded its allowed bandwidth at fpc 2 for 1 times, started at 2023-11-16 13:11:41 CST Nov 16 13:12:16 RouterB rpd[37932]: BGP_IO_ERROR_CLOSE_SESSION: BGP peer 2001:db8:1:255::1 (External AS 64497): Error event Operation timed out(60) for I/O session - closing it (instance master) Nov 16 13:12:16 RouterB rpd[37932]: RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 2001:db8:1:255::1 (External AS 64497) changed state from Established to Idle (event HoldTime) (instance master) Nov 16 13:12:16 RouterB rpd[37932]: bgp_io_mgmt_cb:2314: NOTIFICATION sent to 2001:db8:1:255::1 (External AS 64497): code 4 (Hold Timer Expired Error), Reason: holdtime expired for 2001:db8:1:255::1 (External AS 64497), socket buffer sndacc: 57 rcvacc: 0 , socket buffer sndccc: 57 rcvccc: 0 TCP state: 4, snd_una: 3321890571 snd_nxt: 3321890609 snd_wnd: 16384 rcv_nxt: 936898106 rcv_adv: 936914490, hold timer 90s, hold timer remain 0s, last sent 11s, TCP port (local 179, remote 55514)
<< During the problem, it is noticed that RouterB keep sending NS every 5 seconds , but never send back NA to RouterA , which indicates a possible one-way communication that RouterB might not be able to receive pkts from RouterA.user@RouterA> monitor traffic interface ae1......14:44:10.627547 In IP6 fe80::cee1:7fff:feab:e7cd > ff02::1:ff00:3: ICMP6, neighbor solicitation, who has 2001:db8:1:12::1, length 3214:44:10.627596 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > fe80::cee1:7fff:feab:e7cd: ICMP6, neighbor advertisement[|icmp6]14:44:10.937397 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > ff02::1:ff00:2: ICMP6, neighbor solicitation[|icmp6]14:44:15.627210 In IP6 fe80::cee1:7fff:feab:e7cd > ff02::1:ff00:3: ICMP6, neighbor solicitation, who has 2001:db8:1:12::1, length 3214:44:15.627274 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > fe80::cee1:7fff:feab:e7cd: ICMP6, neighbor advertisement[|icmp6]14:44:15.937401 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > ff02::1:ff00:2: ICMP6, neighbor solicitation[|icmp6]14:44:20.638175 In IP6 fe80::cee1:7fff:feab:e7cd > ff02::1:ff00:3: ICMP6, neighbor solicitation, who has 2001:db8:1:12::1, length 3214:44:20.638224 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > fe80::cee1:7fff:feab:e7cd: ICMP6, neighbor advertisement[|icmp6]14:44:20.937405 Out IP6 truncated-ip6 - 12 bytes missing!fe80::f6bf:a8ff:fe61:293d > ff02::1:ff00:2: ICMP6, neighbor solicitation[|icmp6]
<< According to ipv6 NS/NA mechanism , the ipv6 neighbor will become unreachable without receiving NA , and it happened in a short time before BGPv6 peer holdtime expired.
user@RouterB# run show ipv6 neighbors | grep 2001:db8:1:12::12001:db8:1:12::1 none unreachable 3 yes no ae1.0
<< At same time all related static route and BGP protocol nh would become reject nh in FIB. All traffic send to BGP routes would hit reject nh on all FPCs , and that is the reason why rejectv6 DDOS Violation were set on all FPCs before BGPv6 peer down.user@RouterB# run show route forwarding-table destination 2001:db8:1:255::1Routing table: default.inet6Internet6:Destination Type RtRef Next hop Type Index NhRef Netif2001:db8:1:255::1/128 user 0 2001:db8:1:12::1 rjct 597 3 ae1.0