Event-based SNMP traps are configured to be generated whenever a DDoS protocol violation is set or cleared on the device and provided instructions on how to verify whether the traps are being generated on the MX side.

Please find configuration of  event-based SNMP traps  below, which will trigger a trap whenever a DDoS violation is set or cleared.

labroot >  show configuration event-options

policy custom-trap {

events [ ddos_protocol_violation_set ddos_protocol_violation_clear ];

then {

raise-trap;

}

}

Please follow below steps to verify if SNMP traps are generated at MX side

Step 1: Ping test: Ping <SNMP_Server_IP> source <lo0_IP>

Run the abve command to verify connectivity between the MX and the SNMP server:

If this works as expected, proceed to the next step.

Step 2: Enable snmp trace options when you observe ddos violation and clear messages. Run the below commands for 5 minutes and after capturing the logs please deactivate

set snmp traceoptions file snmp.trace

set snmp traceoptions file size 10m

set snmp traceoptions file files 10

set snmp traceoptions flag all

Step 3:  Monitor traffic on the interface leading to the SNMP server

 Please run the below command for 5-10 minutes to capture relevant logs . Issue this command when you observe the ddos logs

 >> monitor traffic interface <interface-to-SNMP-server> no-resolve matching "udp port 162"

 Step 4: Perform packet capture

 If you want to capture the traffic for further analysis, you can also issue below command for packet capture

 >> monitor traffic interface <interface-to-SNMP-server> no-resolve matching "udp port 162" write-file /var/log/SNMP.pcap

Step 5 : Spoofing enterprise specific SNMP traps 

>> request snmp spoof-trap trap <name> 

The above command is for simulating a trap to the NMS, which normally receives the device’s traps. You can also add required values by using the variable-bindings parameter. This command is used to mimic SNMP trap behavior. The contents of the traps (the values and instances of the objects carried in the trap) can be specified on the command line or automatically spoofed. This feature is useful to trigger SNMP traps from routers and ensure that they are processed correctly within your existing network management infrastructure.