This article provides info about one of the reported problems for intermittent ICMPv6 packet drops when pinging Juniper’s link-local address from an adjacent Arista device. Lab testing confirmed the behaviour is linked to DDoS protection mechanisms affecting ICMPv6 traffic.

Device details are as below:
{master}
user@router-re0> show system information
Model: ptx10008
Family: junos
Junos: 21.4R3-S5.9-EVO
Hostname: router-re0

Customer reported that they are checking the response between ARISTA and Juniper, and checking from the Arista device.

--- fe80::62c7:8dff:fef5:f4f8%et13_1 ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9ms
rtt min/avg/max/mdev = 0.585/0.645/0.718/0.033 ms, ipg/ewma 1.000/0.661 ms

--- fe80::62c7:8dff:fef5:f4f8%et13_1 ping statistics ---
100 packets transmitted, 100 received, 0% packet loss, time 67ms
rtt min/avg/max/mdev = 0.400/0.481/0.728/0.058 ms, ipg/ewma 0.674/0.476 ms

--- fe80::62c7:8dff:fef5:f4f8%et13_1 ping statistics ---
1000 packets transmitted, 980 received, 2% packet loss, time 1025ms
rtt min/avg/max/mdev = 0.385/0.519/3.858/0.122 ms, ipg/ewma 1.025/0.567 ms

--- fe80::62c7:8dff:fef5:f4f8%et13_1 ping statistics ---
3000 packets transmitted, 2805 received, 6.5% packet loss, time 4764ms
rtt min/avg/max/mdev = 0.420/0.599/1.176/0.055 ms, ipg/ewma 1.588/0.596 ms

--- fe80::62c7:8dff:fef5:f4f8%et13_1 ping statistics ---
10000 packets transmitted, 9101 received, 8.99% packet loss, time 17669ms
rtt min/avg/max/mdev = 0.370/0.575/5.020/0.105 ms, ipg/ewma 1.767/0.606 ms

The reported behaviour of ICMPv6 packet drops from an adjacent device when using link-local addresses was successfully reproduced and analysed in a controlled lab environment.

The following observations were made:

• Initial testing with identical hardware and software versions, but without the RSI configuration, showed no ICMPv6 response packet drops when using link-local addresses.
• After applying the RSI configuration and testing various configuration permutations, a consistent pattern of ICMPv6 packet drops was observed.
• Further analysis confirmed that the DDoS protection feature was responsible for these patterned drops.
• To validate this, DDoS protection was disabled in the lab setup, and the same ICMPv6 test was repeated.
• With DDoS protection turned off, no packet drops were observed, confirming the feature's role in the behaviour.

labroot@router01-user01-re0# run show ddos-protection protocols icmp aggregate   

Apr 23 09:49:58

Currently tracked flows: 0, Total detected flows: 0

* = User configured value

Protocol Group: ICMP

 Packet type: aggregate (Aggregate for all ICMP traffic)

  Aggregate policer configuration:

   Bandwidth:    500 pps

   Burst:      500 packets 

   Recover time:   300 seconds 

   Enabled:     Yes

  System-wide information:

   Aggregate bandwidth is no longer being violated

    Last violation started at: 2025-04-23 09:40:38 PDT

    Last violation ended at:  2025-04-23 09:40:53 PDT

    Duration of last violation: 00:00:15 Number of violations: 3

   Received: 151150       Arrival rate:   0 pps

   Dropped:  239         Max arrival rate: 1316 pps

  Routing Engine information:

   Bandwidth: 500 pps, Burst: 500 packets, enabled

   Aggregate policer is never violated

   Received: 218786       Arrival rate:   0 pps

   Dropped:  0          Max arrival rate: 1323 pps

    Dropped by individual policers: 0

  FPC slot 0 information:

   Bandwidth: 100% (500 pps), Burst: 100% (500 packets), enabled

   Aggregate policer is no longer being violated

    Last violation started at: 2025-04-23 09:40:38 PDT

    Last violation ended at:  2025-04-23 09:40:53 PDT

    Duration of last violation: 00:00:15 Number of violations: 3

   Received: 151150       Arrival rate:   0 pps

   Dropped:  239         Max arrival rate: 1316 pps

    Dropped by individual policers: 0

    Dropped by aggregate policer:  239

    Dropped by flow suppression:  0

{master}[edit]

labroot@router01-user01-re0# run show ddos-protection protocols icmp aggregate   

Apr 23 09:51:03

Currently tracked flows: 0, Total detected flows: 0

* = User configured value

Protocol Group: ICMP

 Packet type: aggregate (Aggregate for all ICMP traffic)

  Aggregate policer configuration:

   Bandwidth:    500 pps

   Burst:      500 packets 

   Recover time:   300 seconds 

   Enabled:     Yes

  System-wide information:

   Aggregate bandwidth is being violated!

    No. of FPCs currently receiving excess traffic: 1

    No. of FPCs that have received excess traffic: 1

    Violation first detected at: 2025-04-23 09:50:34 PDT

    Violation last seen at:   2025-04-23 09:50:54 PDT

    Duration of violation: 00:00:20 Number of violations: 4

   Received: 161150       Arrival rate:   0 pps

   Dropped:  263         Max arrival rate: 1316 pps

  Routing Engine information:

   Bandwidth: 500 pps, Burst: 500 packets, enabled

   Aggregate policer is never violated

   Received: 228762       Arrival rate:   0 pps

   Dropped:  0          Max arrival rate: 1323 pps

    Dropped by individual policers: 0

  FPC slot 0 information:

   Bandwidth: 100% (500 pps), Burst: 100% (500 packets), enabled

   Aggregate policer is currently being violated!

    Violation first detected at: 2025-04-23 09:50:34 PDT

    Violation last seen at:   2025-04-23 09:50:54 PDT

    Duration of violation: 00:00:20 Number of violations: 4

   Received: 161150       Arrival rate:   0 pps

   Dropped:  263         Max arrival rate: 1316 pps

    Dropped by individual policers: 0

    Dropped by aggregate policer:  263

    Dropped by flow suppression:  0

{master}[edit]

labroot@router01-user01-re0#

As a solution, it's important to understand how Junos implements DDoS protection for the Routing Engine (RE). This protection is specifically applied to control plane traffic and includes protocol-based policing, dynamic thresholds, and hardware offload mechanisms to safeguard the RE from excessive or malicious traffic.

• Classification of Traffic
  Juniper separates traffic into:

  • Transit Traffic – Passed through the device.
  • Control Plane Traffic – Destined to the RE itself (e.g., BGP, OSPF, SSH, SNMP).
    Only control plane traffic is subject to RE DDoS protection.

• Protocol-Based Policing
  The system tracks the rate of different control plane protocol packets, such as:

  • BGP
  • OSPF
  • ICMP
  • SSH, Telnet
  • SNMP
  • ARP
    Each protocol has an individual threshold (packets per second, PPS). If traffic exceeds that rate, Junos:
  • Starts dropping excess packets (soft policing), or
  • May begin hard drops if the overage persists or is extreme.

• Dynamic Threshold Adjustment
  Junos uses adaptive thresholds based on normal traffic patterns and hardware capacity. These can be dynamically adjusted by the system or manually configured.

• Protection Mechanisms

  • Rate limiting: Limits the PPS to the RE per protocol.
  • Logging and alerts: Sends syslog messages when thresholds are exceeded.
  • Blackholing or discard actions: For persistent threats.

• Hardware Offload
  Many Juniper platforms (e.g., MX series) offload control-plane policing to the PFE (Packet Forwarding Engine), preventing malicious traffic from ever reaching the RE.