Scenarios where we see EX4100/EX4400 switches showing DDOS violation, however, previously we had very limited support to do any tuning on the PPS (Packet Per Second) for these switches.

In the below output we can see that the switch is having multiple violation under VXLAN protocol.


root@ex4400> show ddos-protection protocols vxlan statistics 
Packet types: 1, Received traffic: 1, Currently violated: 0
Protocol Group: VXLAN

  Packet type: aggregate
    System-wide information:
      Aggregate bandwidth is no longer being violated
        No. of FPCs that have received excess traffic: 1
        Last violation started at: 2025-05-14 09:00:18 UTC
        Last violation ended at:   2025-05-14 09:01:33 UTC
        Duration of last violation: 00:01:15 Number of violations: 337
      Received:  247601966           Arrival rate:     53 pps
      Dropped:   2056538             Max arrival rate: 5306 pps
    Routing Engine information:
      Aggregate policer is never violated
      Received:  0                   Arrival rate:     0 pps
      Dropped:   0                   Max arrival rate: 0 pps
        Dropped by individual policers: 0
    FPC slot 0 information:
      Aggregate policer is no longer being violated
        Last violation started at: 2025-05-14 09:00:18 UTC
        Last violation ended at:   2025-05-14 09:01:33 UTC
        Duration of last violation: 00:01:15 Number of violations: 337
      Received:  247601966           Arrival rate:     53 pps
      Dropped:   2056538             Max arrival rate: 5306 pps
        Dropped by individual policers: 0
        Dropped by aggregate policer:   2056538
        Dropped by flow suppression:    0
      Flow counts:
        Aggregation level     Current       Total detected   State
        Subscriber            0             0                Active

root@ex4400> show ddos-protection protocols vxlan statistics 
Packet types: 1, Received traffic: 1, Currently violated: 0
Protocol Group: VXLAN

  Packet type: aggregate
    System-wide information:
      Aggregate bandwidth is no longer being violated
        No. of FPCs that have received excess traffic: 1
        Last violation started at: 2025-03-28 09:40:08 UTC
        Last violation ended at:   2025-03-28 09:40:08 UTC
        Duration of last violation: 00:00:00 Number of violations: 1
      Received:  31307819            Arrival rate:     9 pps
      Dropped:   9382                Max arrival rate: 1951 pps
    Routing Engine information:
      Aggregate policer is never violated
      Received:  0                   Arrival rate:     0 pps
      Dropped:   0                   Max arrival rate: 0 pps
        Dropped by individual policers: 0
    FPC slot 0 information:
      Aggregate policer is no longer being violated
        Last violation started at: 2025-03-28 09:40:08 UTC
        Last violation ended at:   2025-03-28 09:40:08 UTC
        Duration of last violation: 00:00:00 Number of violations: 1
      Received:  31307819            Arrival rate:     9 pps
      Dropped:   9382                Max arrival rate: 1951 pps
        Dropped by individual policers: 0
        Dropped by aggregate policer:   9382
        Dropped by flow suppression:    0
      Flow counts:
        Aggregation level     Current       Total detected   State
        Subscriber

Support to configure; DDoS protocol using CLI (EX4100 and EX4400) Using CLI--Starting in Junos OS Release
24.2R1, you can configure; the distributed denial of service (DDOS) protocol using CLI on EX4100
and EX4400 devices. You can also use the following operational commands to view the DDOS
protocol information
• show ddos-protection protocols
• show ddos-protection statistics
• show ddos-protection protocols violations
• show ddos-protection protocols parameters
• show ddos-protection protocols statistics
• clear ddos-protection protocols

N/A

2025-0514-696778