We have some subscribers with devices which send DHCPv6 Information Request messages, and when they do not get an answer from MX, they re-send these messages over and over. This leads to the hitting of the DDoS rate limiters and impacts normal subscriber traffic. The MX BNG DHCP logs say:

Dec 6 22:47:18.591598 [DEBUG][default:Customers][SVR][INET6][ps10.3221460122] dhcpv6_packet_decode: dhcpv6 pkt parsing - End

Dec 6 22:47:18.591625 [DEBUG] dhcpv6_is_alq_topology_discover_message: ALQ: is topologydiscover 0

Dec 6 22:47:18.591639 [DEBUG] dhcpv6_packet_handle: ALQ: LQ update skipped - Not expected

Dec 6 22:47:18.591668 [NOTE] dhcpv6_packet_handle: dhcpv6_validate_msgs failed: Invalid packet

Dec 6 22:47:18.591685 [DEBUG][default:Customers][SVR][INET6][ps10.3221460122] dhcpv6_packet_handle: leasequeryreply No, retries 0

Dec 6 22:47:18.591698 [DEBUG] dhcpv6_packet_free: PACKET - Freeing v6 packet 0xac31e80

MX drops the DHCPv6 Information-Request packet if there have server-identifier option included in the packet.

If the DHCPv6 information-request packet has server-identifier option included, MX treats it as invalid packet and drops it. If there has no server-identifier included, the packet will be processed as normal. This problem is fixed by PR1779273.

DHCPv6

  Message type: Information-request (11)

  Transaction ID: 0xa1ce38

  Client Identifier

    Option: Client Identifier (1)

    Length: 10

    DUID: 000300013498b5a96297

    DUID Type: link-layer address (3)

    Hardware type: Ethernet (1)

    Link-layer address: 34:98:b5:a9:62:97

  Server Identifier

    Option: Server Identifier (2)

    Length: 26

    DUID: 00020000058331633a39633a38633a31393a31373a6638000000

    DUID Type: assigned by vendor based on Enterprise number (2)

    Enterprise ID: Juniper Networks/Funk Software (1411)

    Identifier: 31633a39633a38633a31393a31373a6638000000

  Elapsed time

    Option: Elapsed time (8)

    Length: 2

    Elapsed time: 0ms

  Option Request

    Option: Option Request (6)

    Length: 12

    Requested Option code: Domain Search List (24)

    Requested Option code: Dual-Stack Lite AFTR Name (64)

    Requested Option code: DNS recursive name server (23)

    Requested Option code: Simple Network Time Protocol Server (31)

    Requested Option code: SIP Server Domain Name List (21)

    Requested Option code: SIP Servers IPv6 Address List (22)