The DDOS Virtual-Chassis: unclassified errors on Juniper devices indicate that unclassified traffic is being flagged by the DoS protection mechanisms, often related to Virtual-Chassis traffic.

Unclassified traffic refers to traffic that doesn’t match any predefined protocol or traffic type categories. This traffic is grouped under a general category because it doesn’t fit into specific queues. This traffic normally comes from the following sources:

• Unknown Protocols: Traffic from applications or devices using non-standard protocols.
• Misconfigured Devices: Incorrect settings leading to unexpected traffic patterns.
• Malicious Traffic: Potential DDoS attacks using unconventional methods.

The following entries are observed in the logs:

DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Virtual-Chassis:unclassified exceeded its allowed bandwidth at fpc 0 for 8745 times, started at 2024-06-24 04:50:36 EDT

DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception Virtual-Chassis:unclassified has returned to normal. Its allowed bandwidth was exceeded at fpc 0 for 8745 times, from 2024-06-24 04:50:36 EDT to 2024-06-24 04:50:36 EDT

DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception ARP:aggregate exceeded its allowed bandwidth at fpc 1 for 1616 times, started at 2024-06-24 04:56:55 EDT

DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception ARP:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 1 for 1616 times, from 2024-06-24 04:56:55 EDT to 2024-06-24 04:57:00 EDT
 

Common causes:

- High traffic levels between the Virtual-Chassis members.

- Misconfiguration or incorrect classification of traffic.

- Network loops or multicast/broadcast storms.

Recommendations:

1 - Verify ARP traffic looks normal, and no no duplicated ARPs hitting the RE constantly:

    > monitor traffic interface irb size 1500 no-resolve matching arp

2 - Review the DDoS configuration, make sure the default values have not been reduced:

    > show configuration system ddos-protection

3 - Investigate the network for loops or excessive traffic.

    > show ethernet-switching mac-learning-logs | match moved

    > show interfaces extensive | match "physical|broadcast|unicast|unknown" <-- run "clear interfaces statistics all" prior to see which ones are cumulating faster

4 - Determine whether the traffic going to RE on step 1 is legitimate or not. If it is legitimate, consider increasing the DDOS protection threshold values for Virtual-Chassis traffic. If the traffic is not Legitimate, do not remove DDOS protection or increase the values:

    # set system ddos-protection protocols virtual-chassis unclassified bandwidth xxxx

    # set system ddos-protection protocols virtual-chassis unclassified burst xxxx

 

2024-09-13 : Article Created
2025-03-06 : Minor changes to formatting. Moved references under the right titles.