Clarification of "set system ddos-protection protocols resolve" & "set system ddos-protection protocols l3nhop"
The set system ddos-protection protocols resolve and set system ddos-protection protocols l3nhop commands are part of Juniper’s Distributed Denial of Service (DDoS) protection feature. This feature is designed to protect the control plane of your router from DDoS attacks
Configuring Control Plane DDoS Protection | Junos OS | Juniper Networks
Resolve: The resolve protocol group in the DDoS protection configuration is related to the process of resolving the next hop for a packet. When a packet is received back at the host, it has the resolve ddos bit set which is resulting in violation, so this protocol group can trigger a violation when certain conditions are met.
protocols (DDoS) | Junos OS | Juniper Networks
L3NHOP protocol means L3 Next Hop. For this violation to occur, the next hop of a packet is set to the CPU by the ASIC (Application-Specific Integrated Circuit) to perform a route lookup, when the next-hop is in HOLD/RSLV or REJECT state. This is triggered when the switch is performing a route lookup and the number of packets or route lookups are greater than the bandwidth limit which in turn causes the DDoS policer to drop the packets at the threshold limit.
https://supportportal.juniper.net/s/article/Information-on-L3NHOP-DDoS
The aggregate bandwidth and aggregate burst parameters define the rate limits for these protocol groups. If the traffic exceeds these limits, it is considered a DDoS attack, and the excess traffic is dropped.
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-ddos-protocols.html#show-ddos-protection-protocols__d111888e101
The aggregate bandwidth and aggregate burst parameters for these protocol groups define the policer values for the DDoS protection mechanism. The bandwidth parameter specifies the number of packets per second that is allowed before a violation is declared, and the burst parameter specifies the maximum number of packets that is allowed in a burst before a violation is declared.
show ddos-protection protocols | Junos OS | Juniper Networks
https://supportportal.juniper.net/s/article/MX-Syslog-message-DDOS-PROTOCOL-VIOLATION-SET-Protocol-resolve-ucast-v4-for-the-MS-MPC-services-card