This article describes a scenario where a customer is seeing LACP DDOS violations on the device. 

Below log messages are seen continuously.

Jun 13 22:45:11 lab-qfx5100 jddosd[2053]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LACP:aggregate exceeded its allowed bandwidth at fpc 0 for 2185 times, started at 2024-06-13 22:45:10 UTC

Jun 13 22:57:10 lab-qfx5100 jddosd[2053]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception LACP:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 2185 times, from 2024-06-13 22:45:10 UTC to 2024-06-13 22:52:08 UTC

There are no visible triggers to the issue.

To isolate the issue, check the following.

1. Check if there are any LACP interface flaps. If the flaps are seen, check for the reason of the flaps and try to resolve it.
2. Check if there are any physical interface issues on the device.
3. Check if there are any other protocols that are showing DDOS violations along with the LACP.
4. Configure centralized mode for LACP (set protocols lacp ppm centralized) so that the LACP packets to be recorded on the RE. Use monitor traffic interface and check if there are any corrupted/unwanted LACP packets reaching the device. 
5. Check the LACP statistics to check if the statistics are as expected.
6. Use KB73272 [juniper.net] to trace the source of the DDOS violation.
7. If the device is running EOL release, try power drain as a workaround. This will help in resolving any transient failures on the device.
8. If the issue still persists, upgrade the device to the latest recommended version and check if the issue is seen in the newer version.
9. If the issue still persists post the upgrade, open JTAC case for further investigation.