We might see few drops when pinging from the remote neighbour to the Juniper device, due to DDOS attacks on the Juniper router.
As the DDOS violations are experienced on most of the FPC's on the MX chassis, we were seeing ping drops from the remote neighbour:
jddosd[13788]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Sample:syslog exceeded its allowed bandwidth at fpc 15 for 159 times, started at 2024-12-28 02:07:42 WIB
jddosd[13788]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Sample:aggregate exceeded its allowed bandwidth at fpc 9 for 132 times, started at 2024-12-28 02:07:43 WIB
jddosd[13788]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Redirect:aggregate exceeded its allowed bandwidth at fpc 10 for 9577 times, started at 2024-12-28 02:13:36 WIB
jddosd[13788]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception Reject:aggregate exceeded its allowed bandwidth at fpc 13 for 14940 times, started at 2024-12-28 02:16:45 WIB
#ping vrf VRF_NAME <IP address> repeat 1000
Type escape sequence to abort.
Sending 1000, 100-byte ICMP Echos to <IP address>, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!.!!!!!!!!!!!!!..!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!.!!!!!!!!!.!.......!..!!!!!!!!!!!!!!!!!!!!!!!!........!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!..
.........!.....!!!.....!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!....
.!!!!!!.....!!!!!!!!
Success rate is 93 percent (934/1000), round-trip min/avg/max = 20/23/53 ms
ping routing-instance VRF_NAME <IP address> rapid count 1000 source <IP address>
PING <IP address> (IP address): 56 data bytes
!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!...!!!!!!!.!!!!!!!!!!!!!!..!!!!!!!!.!!!!!!!!!!!!!..!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!..!!!!!!!!!!!!.!!!!!!!!!!!..!!!!!!!!!!!!!!!.!!!!!!!!..!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!.!!!!..!!!!!!!!!!!.!!!!!!!!!!!!..!!!!!!!!!!!.!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!.!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
--- <IP address> ping statistics ---
1000 packets transmitted, 943 packets received, 5% packet loss
round-trip min/avg/max/stddev = 21.137/22.867/80.335/4.595 ms
Sometimes it is possible to observe ICMP (Internet Control Message Protocol) packet drops when a rapid ping is used to the remote side of a directly connected interface while using the default class-of-service configuration.
In any juniper devices when we ping jumbo packet size along with rapid count these drops will be seen even if its direct Point to point connectivity, this is explained on the KB28175 [juniper.net]: https://supportportal.juniper.net/s/article/Junos-Platform-ICMP-drops-observed-with-a-rapid-ping-to-Junos-platform?language=en_US
However, on our case we don't have CoS related configurations on the MX router configured.
Secondly, we could see DDOS violations occurring on almost all the FPC's. DDOS violations could occur, when the traffic floods to the same destination by multiple or single host targeting it. These packets are reported as DDOS violations on the Juniper devices, to know the user that the router is experiencing huge network traffic flow for the particular FRU, particular source IP/MAC and from the protocol which its violating.
On Junos platforms, we have a default protection mechanism built to help prevent denial of service (DoS) attacks for ICMP Host Inbound connections. By default, ICMP rate is set to 1000 and this can be changed as per customer requirement. If one protocol exceeds the rate limit and the packets from that protocol are trusted, then we may consider increasing the rate limit for that protocol.
We would suggest you to set the bandwidth value less than 10000 pps (like 3000, 2000, 5000) Reason: On certain cases the DDoS policers do not work as per configured bandwidth) Please find the KB35838 [juniper.net] for your reference https://supportportal.juniper.net/s/article/QFX-DDoS-Protection-rate-limit-is-not-working-as-per-the-configured-bandwidth
And for determining the right value for your network, we would suggest you to try contacting your account manager to review the network and set the rate-limiting configurations accordingly.
You can also find more information about ‘why & how to Rate Limit ICMPv4 and ICMPv6’ on the below URL:
https://www.juniper.net/documentation/us/en/software/junos/transport-ip/topics/topic-map/icmp.html