This article explains about after upgrading the router to 22.x and later versions, customer might notice issues with the SNMP graphing, graphs might looking very erratic / spiky in comparison to before the upgrade.
Customer tried to reduce the number of SNMP queries to this Edge router, which was slightly better, but it's still not like last week's traffic. At first we thought it was something wrong with the device but I think this is more an SNMP issue.
Unexpected spikes can be seen at random periods as evident below:
Issue can be mainly seen with Edge routers with many interfaces rather than core router with lesser interfaces.
Also, one can see DDoS violation logs as shown below:
Feb 7 23:04:28.153 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception SNMP:aggregate exceeded its allowed bandwidth at fpc 8 for 4 times, started at 2025-02-07 23:04:27 SAST
Feb 7 23:12:37.025 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception SNMP:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 8 for 4 times, from 2025-02-07 23:04:27 SAST to 2025-02-07 23:07:36 SAST
Feb 7 23:13:50.109 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception SNMP:aggregate exceeded its allowed bandwidth at fpc 8 for 5 times, started at 2025-02-07 23:13:49 SAST
Feb 7 23:18:20.475 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception SNMP:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 0 for 3 times, from 2025-02-07 17:43:17 SAST to 2025-02-07 23:13:20 SAST
Feb 7 23:22:40.855 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception SNMP:aggregate exceeded its allowed bandwidth at fpc 0 for 4 times, started at 2025-02-07 23:22:40 SAST
Feb 7 23:27:37.222 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception SNMP:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 8 for 5 times, from 2025-02-07 23:13:49 SAST to 2025-02-07 23:22:36 SAST
Feb 7 23:59:42.567 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception SNMP:aggregate exceeded its allowed bandwidth at fpc 8 for 6 times, started at 2025-02-07 23:59:42 SAST
---------------------
Feb 8 02:22:43.011 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception SNMP:aggregate exceeded its allowed bandwidth at fpc 8 for 11 times, started at 2025-02-08 02:22:42 SAST
Feb 8 02:36:38.216 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception SNMP:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 8 for 11 times, from 2025-02-08 02:22:42 SAST to 2025-02-08 02:31:37 SAST
Feb 8 02:43:14.891 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception SNMP:aggregate exceeded its allowed bandwidth at fpc 8 for 12 times, started at 2025-02-08 02:43:14 SAST
Feb 8 02:43:42.890 2025 Router jddosd[16044]: %DAEMON-4-DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception SNMP:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 2 for 2 times, from 2025-02-07 15:22:32 SAST to 2025-02-08 02:38:37 SAST
The above logs suggest that the router's SNMP traffic exceeded the default DDoS protection limits, leading to violations.
DDOS protection was added to rate limit the maximum protocol packets that the respective daemon could handle per second without the respective service getting stalled.
The default bandwidth and burst policer values for SNMP DDoS protection have been significantly reduced in Junos version 22.x and later versions.
Default bandwidth value from 20000 pps to 100 pps and burst policer value from 20000 packets to 100 packets.
Due to this DDOS violations for protocol SNMP may triggered.
We can use the below command to examine the current DDoS protection settings for SNMP (Kindly share the same as well):
> show ddos-protection protocols snmp
If you're experiencing excessive logging due to legitimate SNMP traffic, consider increasing the bandwidth and burst values.
Use the following commands to modify the configuration:
#set system ddos-protection protocols snmp aggregate bandwidth <>
#set system ddos-protection protocols snmp aggregate burst <>
Replace <> with appropriate values based on your network's specific requirements.