Lab topo：
 

IXIA---(xe-0/0/0)MX480(xe-0/2/0)----mx
 

MX480 CLI:

set system ddos-protection protocols resolve aggregate disable-routing-engine

set system ddos-protection protocols resolve aggregate disable-fpc

set system ddos-protection protocols resolve ucast-v4 disable-routing-engine

set system ddos-protection protocols resolve ucast-v4 disable-fpc

set chassis network-services enhanced-ip

set interfaces xe-0/0/0 unit 0 family inet address 12.1.1.2/24

set interfaces xe-0/2/0 unit 0 family inet address 34.1.1.3/24

MX480 route table：

labroot@avocado-re0> show route 

inet.0: 8 destinations, 9 routes (8 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

0.0.0.0/0     *[Static/5] 3d 20:05:46

          > to 10.85.248.1 via fxp0.0

10.85.248.0/25   *[Direct/0] 3d 20:05:46

          > via fxp0.0

          [Direct/0] 3d 20:05:46

          > via fxp0.0

10.85.248.7/32   *[Local/0] 3d 20:05:46

            Local via fxp0.0

10.85.248.9/32   *[Local/0] 3d 20:05:46

            Local via fxp0.0

12.1.1.0/24    *[Direct/0] 03:22:41

          > via xe-0/0/0.0

12.1.1.2/32    *[Local/0] 03:22:41

            Local via xe-0/0/0.0

34.1.1.0/24    *[Direct/0] 03:24:56

          > via xe-0/2/0.0

34.1.1.3/32    *[Local/0] 03:24:56

            Local via xe-0/2/0.0

IXIA send packet DST addr "34.1.1.5" No router in this topology has this address, so that mx480 can always send requests

Check FPC status:

labroot@avocado-re0# run show chassis fpc   

           Temp CPU Utilization (%)  CPU Utilization (%) Memory  Utilization (%)

Slot State      (C) Total Interrupt   1min  5min  15min DRAM (MB) Heap   Buffer

 0 Online      45   75     50    60   42   36  2048    17     19   <<<<CPU Interrupt high

Syslog:

request pfe execute command "show syslog messages" target fpc0 

[Mar 25 06:07:00.923 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled <<<<<<472 = mx480 interface connect ixia 

[Mar 25 06:07:24.473 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled

[Mar 25 06:07:48.023 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled

[Mar 25 06:08:08.038 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled

[Mar 25 06:08:28.061 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled

[Mar 25 06:08:48.084 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled

[Mar 25 06:09:08.111 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled

[Mar 25 06:09:28.140 LOG: Info] nh_resolve_throttle:1668Next-hop resolution requests from interface 472 throttled


Conclusion:

The FPC receives a large number of arp requests and does not enable ddos protection. The CPU on the FPC is high.

"enable ddos-protection" can solve the problem