This article explains how to verify if the dlu.ucode.not_routable trapcode is incrementing for the genuine packet drops or its incrementing again non routable spoofed packet which is an expected behavior.
DLU - stands for "Destination Look up" - a functional block in an ASIC which responsible for looking up the destination of the packet.ucode - microcodenot_routable - not able to find a route or next-hop matching the prefix that the DLU
So, "dlu.ucode.not_routable" is a notification the ASIC makes when the DLU is not able to find a route matching the destination of a packet.
You may see the trapcode dlu.ucode.not_routable incrementing which may not impact any traffic howeever the count keeps incrementing.
labroot@lab_router> request pfe execute command "show pechip trapstat" target fpc1 | match not | refresh 5
---(refreshed at 2024-01-10 08:16:56 PST)---
0 (8) dlu.ucode.not_routable 29677614 0
1 (8) dlu.ucode.not_routable 3971999 0
2 (8) dlu.ucode.not_routable 4897774 0
3 (8) dlu.ucode.not_routable 5238871 0
4 (8) dlu.ucode.not_routable 7778856 0
5 (8) dlu.ucode.not_routable 3400042 0
---(refreshed at 2024-01-10 08:17:32 PST)---
0 (8) dlu.ucode.not_routable 29678916 0
1 (8) dlu.ucode.not_routable 3977734 0
4 (8) dlu.ucode.not_routable 7789634 0
5 (8) dlu.ucode.not_routable 3405658 0
---(refreshed at 2024-01-10 08:17:50 PST)---
0 (8) dlu.ucode.not_routable 29682020 0
1 (8) dlu.ucode.not_routable 3979740 0
2 (8) dlu.ucode.not_routable 4901664 0
3 (8) dlu.ucode.not_routable 5242315 0
4 (8) dlu.ucode.not_routable 7796829 0
5 (8) dlu.ucode.not_routable 3410517 0
In 0rder to verify if the counter are genuine traffic drop or expected one first we need to collect the trapcode dump in order to verify the content of the packet that is being dropped. You can use the below KB article to collect the trapcode dump.
https://supportportal.juniper.net/s/article/PTX-Collecting-trapcode-dumps-for-dropped-packets
Once collected you need to decide the packet to find the IP address and MAC address. You can use the below online packet decoder for the same.
https://hpd.gasmi.net/
In our case after decoding we found that the source and destination IP's does not belonged to customer's neetwork and seems spoofed.
2401:db00:31ff:ff4c:face:b00c:0000:755c
2401:db00:31ff:ffbf:face:b00c:0000:7c0b
2401:db00:31ff:ff4a:face:b00c:0000:2c62
MAC Address:
SMAC: 25:78:64:80:00:00 → DMAC: 2a:99:e4:78:00:00
Once you have the above information shared it with customoer and they should be able to trace the origin of this spoofed traffic using the IP's and MAC address information in their netwrok and should be able to stop it.