Description

EX4400 crash after executing "show ddos socket" on the FPC vty

Symptoms

Issue:

 

Device crashed after VTY command “show ddos socket” was executed. This command was used to collect data for a separate case we are investigating where TCP timer messages are seen in the logs.

 

Logs observed after executing "show ddos socket" on the VTY: 

 

Feb 22 17:46:53 rcv: ch_ipc_dispatch() ETIMEDOUT TCP/IP pipe ipc read for args 0xa8149a0 pipe 0xa9d3440, fru FPC 0 errno 60

Feb 22 17:46:53 rcv: ch_ipc_dispatch() ipc pipe read error for args 0xa8149a0 pipe 0xa9d3440, fru FPC 0 subfru 0 errno 0

Feb 22 17:46:53 ch_connection_shutdown: Destroying the IPC pipe

<>

Feb 22 17:46:53 CHASSISD_IPC_CONNECTION_DROPPED: Dropped IPC connection for FPC 0

Feb 22 17:46:53 CHASSISD_IFDEV_DETACH_FPC: ifdev_detach_fpc(0)

 

Feb 22 17:46:53 fpc_disconnect_finish: FPC 0 slc_slot 0 Offline reason 0 clean_shutdown 0

Feb 22 17:46:53 fpc_offline_now - slot 0, slc_slot 0 reason: None, error Chassis connection dropped transition state 1

Feb 22 17:46:53 CHASSISD_SNMP_TRAP3: ENTITY trap generated: entStateOperDisabled (entPhysicalIndex 120, entStateAdmin 3, entStateAlarm 0)

Feb 22 17:46:53 CHASSISD_SNMP_TRAP0: ENTITY trap generated: entConfigChanged

 

Feb 22 17:46:53 CHASSISD_SNMP_TRAP7: SNMP trap generated: FRU removal (jnxFruContentsIndex 7, jnxFruL1Index 1, jnxFruL2Index 0, jnxFruL3Index 0, jnxFruName FPC: EX4400-48P @ 0/*/*, jnxFruType 3, jnxFruSlot 0)

Feb 22 17:46:53 fru_nmi_timer: NMI timer expired for FPC 0

Feb 22 17:46:53 CHASSISD_FRU_NMI_RESTART: fru_nmi_timer: Restart FPC 0 due to NMI timeout 

 

Solution

Root Cause/Next steps:

 

DDoS config modules are not supported on EX4400 and the VTY command “show ddos socket” triggered the crash.

The issue has been replicated in the lab. Engineering team has identified the issue and is working on adding a preventative fix in the next release.

   

This apply for all Junos EX platforms . Currently Ex doesnt support configuring DDOS feature. 
During bootup, some of the data structures will not be initialised. So when the VTY CLI show ddos socket  is used, It generates a core file.

On the Junos EX platform when VTY command to check DDoS (Distributed Denial of Service) protection is executed from the FPC (Flexible PIC Concentrator) shell, 
it leads to the device crashing with a fxpc crash file being generated on the device.
Configurable DDOS is not supported on Ex device.

Workaround:

stop using "show ddos socket"command on EX platforms, as ddos is not support not available

This issue has been fixed through PR1717747.

Modification History

2024-03-29 : Article Created