Log messages flooded with DDOS_PROTOCOL_VIOLATION_SET logs.

Aug 2 00:40:37 JTAC ddosd[9252]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception ARP:aggregate exceeded its allowed bandwidth at routing-engine for 1006 times, started at 2024-08-02 00:40:37 UTC

root@JTAC> show ddos-protection protocols arp

Packet types: 1, Modified: 0, Received traffic: 1, Currently violated: 1

Currently tracked flows: 0, Total detected flows: 0

* = User configured value

Protocol Group: ARP

 Packet type: aggregate (Aggregate for all arp traffic)

  Aggregate policer configuration:

   Bandwidth:    500 pps

   Burst:      512 packets

   Recover time:   300 seconds

   Enabled:     Yes

  System-wide information:

   Aggregate bandwidth is being violated!

No. of FPCs currently receiving excess traffic: 1

No. of FPCs that have received excess traffic: 1

Violation first detected at: 2024-08-16 06:28:15 UTC

Violation last seen at:   2024-08-16 07:00:53 UTC

Duration of violation: 00:32:38 Number of violations: 4087

   Received: 352269032      Arrival rate:   123 pps

   Dropped:  2377574       Max arrival rate: 16986 pps

The default ARP aggregate BW for this BW 500 pps. Hence if the arrival rate increases beyond this, logs will be generated.

The control plane modifications are not suggested, since if we allot more BW for arp, the high arp flow can hamper the RE, for this model.

RE memory or queues can get choked due to high inflow, if we modify the arp BW to 17k, as in symptoms output.

The ARP Policer feature has been introduced in ACX7000 in RLI 55991 and the feature is available from EVO 24.1R1 onwards.

Hence until then we may need to restrict the arp flow at l2 itself.

Policer knob is hidden in releases lower than 24.1R1-EVO, since it is not supported.

Sample ARP policer (for config after upgrade to 241.R1-EVO or above):

set firewall policer arp_limit if-exceeding bandwidth-limit <value>

set firewall policer arp_limit if-exceeding burst-size-limit <value>

set firewall policer arp_limit then discard

set interfaces <all-vlan-interfaces-facing-l2> unit <unit> family inet policer arp arp_limit