This article will discuss DDoS violations related to NDPv6 and explain why the Juniper core switch takes longer than 1 to 5 seconds to respond to ICMPv6 Neighbor Solicitation packets with Neighbor Advertisements. This delay can lead to traffic blackholes.

Model: as7816-64x

Junos: 21.4R3-S2.3

A non-Juniper device sends a Neighbor Solicitation message to the core switch. core switch taking time of 1-5 sec on host path to RE. However, the RE quickly sends a Neighbor Advertisement back to the non-Juniper device.

We can observe a DDoS violation related to NDPv6, with 77 million dropped packets.

This command will provide details about the traffic and any detected violations.

> show ddos-protection protocols ndpv6 statistics 
 

We can check the ICMPv6 packets using the tcpdump command. Here’s how you can do it:

> monitor traffic interface <peer-connected-interface> matching icmp6 size 1500 extensive write-file jtactest.pcap layer2-headers

We need to adjust the bandwidth for the aggregate and increase the queue size in response to the DDoS violation.

#set system ddos-protection protocols ndpv6 aggregate bandwidth 900

#set system ddos-protection protocols ndpv6 aggregate burst 300

We can confirm the aggregate and increase the queue size via below command.

(vty)# show ddos policer all configuration

After increasing the aggregate and queue size, we observed that the Neighbor Solicitation (NS) packet response time improved to milliseconds, and no DDoS violations for NDPv6 occurred.