[rover-lt]

Jun  2 08:16:31  rtc-edge-16-a rpd[1467]: RPD_OSPF_NBRDOWN: OSPF neighbor X.Y.0.61 (realm ospf-v2 ge-1/1/0.0 area 0.0.0.0) state changed from Full to Down due to InActiveTimer (event reason: BFD session timed out and neighbor was declared dead)
Jun  2 08:16:35  rtc-edge-16-a jddosd[1484]: DDOS_PROTOCOL_VIOLATION_SET: Protocol resolve:mcast-v4 is violated at fpc 0 for 154 times, started at 2016-06-02 08:16:34 UTC
Jun  2 08:21:39  rtc-edge-16-a jddosd[1484]: DDOS_PROTOCOL_VIOLATION_CLEAR: Protocol resolve:mcast-v4 has returned to normal. Violated at fpc 0 for 154 times, from 2016-06-02 08:16:34 UTC to 2016-06-02 08:16:38 UTC
Jun  2 11:36:05  rtc-edge-16-a rpd[1467]: RPD_OSPF_NBRDOWN: OSPF neighbor X.Y.0.61 (realm ospf-v2 ge-1/1/0.0 area 0.0.0.0) state changed from Full to Down due to InActiveTimer (event reason: BFD session timed out and neighbor was declared dead)
Jun  2 11:36:08  rtc-edge-16-a jddosd[1484]: DDOS_PROTOCOL_VIOLATION_SET: Protocol resolve:mcast-v4 is violated at fpc 0 for 155 times, started at 2016-06-02 11:36:08 UTC
Jun  2 11:41:09  rtc-edge-16-a jddosd[1484]: DDOS_PROTOCOL_VIOLATION_CLEAR: Protocol resolve:mcast-v4 has returned to normal. Violated at fpc 0 for 155 times, from 2016-06-02 11:36:08 UTC to 2016-06-02 11:36:09 UTC

 

имею вот такую штуку и не могу понять, OSPF падает из-за того что мультикаст-шторм начинается или DDOS_PROTOCOL_VIOLATION появляется из-за того, что OSPF упал и трафику "некуда деваться" во время пересчета маршрутов?

Пакеты на обоих концах не дропаются согласно "show interface queue"

[orlik]

Ну тут зависит от того что у вас сконфигурено для ddos protection и фильтр на lo0

А вообще я бы предположил что мультикаст шторм заваливает ospf и четь позже срабатывает ddos protection

[zlolotus]

Можно гадать на кофейной гуще, мы сделали просто.

 

Отключили этот ддос протекшион. И написали фильтр, и спим спокойно.

[rover-lt]

Ну тут зависит от того что у вас сконфигурено для ddos protection и фильтр на lo0

...

Нашел, что косяк не тут был. Нашел, что провайдер линка на котором дропался BFD/OSPF зарейтлимитил с burst size = 10ms, в то время как shaper-profile на интерфейсе стоит с burst-size=100ms

[orlik]

Ну тут зависит от того что у вас сконфигурено для ddos protection и фильтр на lo0

...

Нашел, что косяк не тут был. Нашел, что провайдер линка на котором дропался BFD/OSPF зарейтлимитил с burst size = 10ms, в то время как shaper-profile на интерфейсе стоит с burst-size=100ms

Забавно, но вы настройте стонетворк-контрол трафик шел с приоритетом ...

[Bercut]

Aug 22 04:14:59  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 59 times, started at 2020-08-22 04:14:59 EEST
Aug 22 04:20:05  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 59 times, from 2020-08-22 04:14:59 EEST to 2020-08-22 04:14:59 EEST
Aug 22 04:22:05  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 60 times, started at 2020-08-22 04:22:05 EEST
Aug 22 04:23:26  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 7 times, started at 2020-08-22 04:23:26 EEST
Aug 22 04:27:06  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 60 times, from 2020-08-22 04:22:05 EEST to 2020-08-22 04:22:05 EEST
Aug 22 04:27:52  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 61 times, started at 2020-08-22 04:27:51 EEST
Aug 22 04:28:27  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 7 times, from 2020-08-22 04:23:26 EEST to 2020-08-22 04:23:26 EEST
Aug 22 04:41:42  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 61 times, from 2020-08-22 04:27:51 EEST to 2020-08-22 04:36:41 EEST
Aug 22 04:42:02  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 62 times, started at 2020-08-22 04:42:02 EEST
Aug 22 04:47:02  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 62 times, from 2020-08-22 04:42:02 EEST to 2020-08-22 04:42:02 EEST
Aug 22 04:47:28  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 63 times, started at 2020-08-22 04:47:27 EEST
Aug 22 04:55:08  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 63 times, from 2020-08-22 04:47:27 EEST to 2020-08-22 04:50:03 EEST
Aug 22 04:57:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 64 times, started at 2020-08-22 04:57:39 EEST
Aug 22 05:02:44  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 64 times, from 2020-08-22 04:57:39 EEST to 2020-08-22 04:57:39 EEST
Aug 22 05:03:44  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 65 times, started at 2020-08-22 05:03:44 EEST
Aug 22 05:08:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 65 times, from 2020-08-22 05:03:44 EEST to 2020-08-22 05:03:44 EEST
Aug 22 05:15:20  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 66 times, started at 2020-08-22 05:15:20 EEST
Aug 22 05:22:26  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 66 times, from 2020-08-22 05:15:20 EEST to 2020-08-22 05:17:24 EEST
Aug 22 05:34:07  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 67 times, started at 2020-08-22 05:34:07 EEST
Aug 22 05:40:38  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 67 times, from 2020-08-22 05:34:07 EEST to 2020-08-22 05:35:36 EEST
Aug 22 05:50:18  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 68 times, started at 2020-08-22 05:50:17 EEST
Aug 22 05:59:55  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 68 times, from 2020-08-22 05:50:17 EEST to 2020-08-22 05:54:53 EEST
Aug 22 06:10:26  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 69 times, started at 2020-08-22 06:10:25 EEST
Aug 22 06:29:48  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 69 times, from 2020-08-22 06:10:25 EEST to 2020-08-22 06:24:46 EEST
Aug 22 06:32:47  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 8 times, from 2020-08-22 00:06:49 EEST to 2020-08-22 06:27:46 EEST
Aug 22 06:35:38  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 9 times, started at 2020-08-22 06:35:37 EEST
Aug 22 07:58:59  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 70 times, started at 2020-08-22 07:58:59 EEST
Aug 22 08:04:05  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 70 times, from 2020-08-22 07:58:59 EEST to 2020-08-22 07:58:59 EEST
Aug 22 08:40:32  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 71 times, started at 2020-08-22 08:40:32 EEST
Aug 22 08:45:33  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 71 times, from 2020-08-22 08:40:32 EEST to 2020-08-22 08:40:32 EEST
Aug 22 08:55:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 72 times, started at 2020-08-22 08:55:39 EEST
Aug 22 09:00:44  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 72 times, from 2020-08-22 08:55:39 EEST to 2020-08-22 08:55:39 EEST
Aug 22 09:22:47  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 73 times, started at 2020-08-22 09:22:46 EEST
Aug 22 09:27:52  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 73 times, from 2020-08-22 09:22:46 EEST to 2020-08-22 09:22:46 EEST
Aug 22 09:42:32  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 74 times, started at 2020-08-22 09:42:32 EEST
Aug 22 09:47:34  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 74 times, from 2020-08-22 09:42:32 EEST to 2020-08-22 09:42:32 EEST
Aug 22 09:48:44  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 75 times, started at 2020-08-22 09:48:43 EEST
Aug 22 09:52:58  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 9 times, from 2020-08-22 02:46:41 EEST to 2020-08-22 09:47:58 EEST
Aug 22 09:52:58  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 9 times, from 2020-08-22 06:35:37 EEST to 2020-08-22 09:47:58 EEST
Aug 22 09:55:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 75 times, from 2020-08-22 09:48:43 EEST to 2020-08-22 09:50:43 EEST
Aug 22 09:56:59  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 10 times, started at 2020-08-22 09:56:58 EEST
Aug 22 10:01:20  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 76 times, started at 2020-08-22 10:01:19 EEST
Aug 22 10:01:49  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 10 times, started at 2020-08-22 10:01:49 EEST
Aug 22 10:06:25  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 76 times, from 2020-08-22 10:01:19 EEST to 2020-08-22 10:01:19 EEST
Aug 22 10:07:55  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 77 times, started at 2020-08-22 10:07:54 EEST
Aug 22 10:12:55  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 77 times, from 2020-08-22 10:07:54 EEST to 2020-08-22 10:07:54 EEST
Aug 22 10:30:41  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 78 times, started at 2020-08-22 10:30:41 EEST
Aug 22 10:35:41  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 78 times, from 2020-08-22 10:30:41 EEST to 2020-08-22 10:30:41 EEST
Aug 22 10:38:13  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 79 times, started at 2020-08-22 10:38:12 EEST
Aug 22 10:43:17  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 79 times, from 2020-08-22 10:38:12 EEST to 2020-08-22 10:38:12 EEST
Aug 22 10:50:59  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 80 times, started at 2020-08-22 10:50:58 EEST
Aug 22 10:58:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 80 times, from 2020-08-22 10:50:58 EEST to 2020-08-22 10:53:44 EEST
Aug 22 11:37:01  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 81 times, started at 2020-08-22 11:37:01 EEST
Aug 22 11:46:43  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 81 times, from 2020-08-22 11:37:01 EEST to 2020-08-22 11:41:37 EEST
Aug 22 11:54:23  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 8 times, started at 2020-08-22 11:54:23 EEST
Aug 22 11:59:29  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 8 times, from 2020-08-22 11:54:23 EEST to 2020-08-22 11:54:23 EEST
Aug 22 12:06:34  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 82 times, started at 2020-08-22 12:06:34 EEST
Aug 22 12:15:15  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 82 times, from 2020-08-22 12:06:34 EEST to 2020-08-22 12:10:14 EEST
Aug 22 12:26:32  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 83 times, started at 2020-08-22 12:26:32 EEST
Aug 22 12:36:53  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 83 times, from 2020-08-22 12:26:32 EEST to 2020-08-22 12:31:53 EEST
Aug 22 12:40:54  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 84 times, started at 2020-08-22 12:40:53 EEST
Aug 22 12:45:59  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 84 times, from 2020-08-22 12:40:53 EEST to 2020-08-22 12:40:58 EEST
Aug 22 12:56:20  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 85 times, started at 2020-08-22 12:56:19 EEST
Aug 22 13:03:30  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 85 times, from 2020-08-22 12:56:19 EEST to 2020-08-22 12:58:25 EEST
Aug 22 13:06:05  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 86 times, started at 2020-08-22 13:06:05 EEST
Aug 22 13:15:57  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 86 times, from 2020-08-22 13:06:05 EEST to 2020-08-22 13:10:56 EEST
Aug 22 13:49:54  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 87 times, started at 2020-08-22 13:49:54 EEST
Aug 22 13:55:55  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 87 times, from 2020-08-22 13:49:54 EEST to 2020-08-22 13:50:53 EEST
Aug 22 13:58:35  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 9 times, started at 2020-08-22 13:58:35 EEST
Aug 22 14:03:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 9 times, from 2020-08-22 13:58:35 EEST to 2020-08-22 13:58:35 EEST
Aug 22 14:23:13  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 88 times, started at 2020-08-22 14:23:12 EEST
Aug 22 14:28:12  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 88 times, from 2020-08-22 14:23:12 EEST to 2020-08-22 14:23:12 EEST
Aug 22 14:34:04  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 89 times, started at 2020-08-22 14:34:04 EEST
Aug 22 14:42:39  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 10 times, started at 2020-08-22 14:42:38 EEST
Aug 22 14:44:39  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 10 times, from 2020-08-22 09:56:58 EEST to 2020-08-22 14:39:38 EEST
Aug 22 14:45:25  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 11 times, started at 2020-08-22 14:45:24 EEST
Aug 22 14:47:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 10 times, from 2020-08-22 14:42:38 EEST to 2020-08-22 14:42:38 EEST
Aug 22 14:49:35  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 11 times, started at 2020-08-22 14:49:35 EEST
Aug 22 14:54:00  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 89 times, from 2020-08-22 14:34:04 EEST to 2020-08-22 14:48:59 EEST
Aug 22 14:54:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 11 times, from 2020-08-22 14:49:35 EEST to 2020-08-22 14:49:35 EEST
Aug 22 14:59:05  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 12 times, started at 2020-08-22 14:59:05 EEST
Aug 22 15:04:06  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 12 times, from 2020-08-22 14:59:05 EEST to 2020-08-22 14:59:05 EEST
Aug 22 15:11:27  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 90 times, started at 2020-08-22 15:11:27 EEST
Aug 22 15:19:43  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 90 times, from 2020-08-22 15:11:27 EEST to 2020-08-22 15:14:42 EEST
Aug 22 15:24:08  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 91 times, started at 2020-08-22 15:24:07 EEST
Aug 22 15:29:08  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 91 times, from 2020-08-22 15:24:07 EEST to 2020-08-22 15:24:07 EEST
Aug 22 15:30:14  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 92 times, started at 2020-08-22 15:30:13 EEST
Aug 22 15:31:18  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3NHOP:aggregate exceeded its allowed bandwidth at fpc 0 for 3 times, started at 2020-08-22 15:31:18 EEST
Aug 22 15:35:20  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 92 times, from 2020-08-22 15:30:13 EEST to 2020-08-22 15:30:13 EEST
Aug 22 15:35:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 10 times, from 2020-08-22 10:01:49 EEST to 2020-08-22 15:30:43 EEST
Aug 22 15:35:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 11 times, from 2020-08-22 14:45:24 EEST to 2020-08-22 15:30:43 EEST
Aug 22 15:45:36  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 11 times, started at 2020-08-22 15:45:35 EEST
Aug 22 15:45:36  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 12 times, started at 2020-08-22 15:45:35 EEST
Aug 22 15:52:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3NHOP:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 3 times, from 2020-08-22 15:31:18 EEST to 2020-08-22 15:47:39 EEST
Aug 22 16:02:02  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 11 times, from 2020-08-22 15:45:35 EEST to 2020-08-22 15:57:00 EEST
Aug 22 16:02:02  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 12 times, from 2020-08-22 15:45:35 EEST to 2020-08-22 15:57:00 EEST
Aug 22 16:25:39  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 93 times, started at 2020-08-22 16:25:38 EEST
Aug 22 16:30:40  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 93 times, from 2020-08-22 16:25:38 EEST to 2020-08-22 16:25:38 EEST
Aug 22 16:32:53  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 13 times, started at 2020-08-22 16:32:53 EEST
Aug 22 16:34:08  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 12 times, started at 2020-08-22 16:34:08 EEST
Aug 22 16:34:08  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 94 times, started at 2020-08-22 16:34:08 EEST
Aug 22 16:48:05  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 94 times, from 2020-08-22 16:34:08 EEST to 2020-08-22 16:42:59 EEST
Aug 22 16:48:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 12 times, from 2020-08-22 16:34:08 EEST to 2020-08-22 16:43:44 EEST
Aug 22 16:49:16  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 13 times, from 2020-08-22 16:32:53 EEST to 2020-08-22 16:44:14 EEST
Aug 22 16:52:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 13 times, started at 2020-08-22 16:52:44 EEST
Aug 22 16:52:45  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 14 times, started at 2020-08-22 16:52:44 EEST
Aug 22 16:53:10  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 95 times, started at 2020-08-22 16:53:09 EEST
Aug 22 17:05:21  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 95 times, from 2020-08-22 16:53:09 EEST to 2020-08-22 17:00:16 EEST
Aug 22 17:05:36  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 96 times, started at 2020-08-22 17:05:36 EEST
Aug 22 17:06:52  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3NHOP:aggregate exceeded its allowed bandwidth at fpc 0 for 4 times, started at 2020-08-22 17:06:51 EEST
Aug 22 17:12:03  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3NHOP:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 4 times, from 2020-08-22 17:06:51 EEST to 2020-08-22 17:07:01 EEST
Aug 22 17:12:12  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 96 times, from 2020-08-22 17:05:36 EEST to 2020-08-22 17:07:07 EEST
Aug 22 17:15:47  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 97 times, started at 2020-08-22 17:15:47 EEST
Aug 22 17:18:38  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 13 times, from 2020-08-22 16:52:44 EEST to 2020-08-22 17:13:36 EEST
Aug 22 17:19:07  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 14 times, from 2020-08-22 16:52:44 EEST to 2020-08-22 17:14:03 EEST
Aug 22 17:38:29  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 14 times, started at 2020-08-22 17:38:28 EEST
Aug 22 17:38:29  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 15 times, started at 2020-08-22 17:38:28 EEST
Aug 22 17:43:29  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 14 times, from 2020-08-22 17:38:28 EEST to 2020-08-22 17:38:28 EEST
Aug 22 17:43:29  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 15 times, from 2020-08-22 17:38:28 EEST to 2020-08-22 17:38:28 EEST
Aug 22 17:46:54  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 13 times, started at 2020-08-22 17:46:54 EEST
Aug 22 17:49:20  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3NHOP:aggregate exceeded its allowed bandwidth at fpc 0 for 5 times, started at 2020-08-22 17:49:19 EEST
Aug 22 17:51:56  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 13 times, from 2020-08-22 17:46:54 EEST to 2020-08-22 17:46:54 EEST
Aug 22 17:58:57  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 15 times, started at 2020-08-22 17:58:56 EEST
Aug 22 17:58:57  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 16 times, started at 2020-08-22 17:58:56 EEST
Aug 22 18:04:28  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 15 times, from 2020-08-22 17:58:56 EEST to 2020-08-22 17:59:25 EEST
Aug 22 18:04:28  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 16 times, from 2020-08-22 17:58:56 EEST to 2020-08-22 17:59:25 EEST
Aug 22 18:09:53  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 97 times, from 2020-08-22 17:15:47 EEST to 2020-08-22 18:04:47 EEST
Aug 22 18:10:22  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  RESOLVE:aggregate exceeded its allowed bandwidth at fpc 0 for 14 times, started at 2020-08-22 18:10:21 EEST
Aug 22 18:11:43  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  IPMC-reserved:aggregate exceeded its allowed bandwidth at fpc 0 for 98 times, started at 2020-08-22 18:11:42 EEST
Aug 22 18:12:03  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 16 times, started at 2020-08-22 18:12:03 EEST
Aug 22 18:12:03  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 17 times, started at 2020-08-22 18:12:03 EEST
Aug 22 18:15:23  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3NHOP:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 5 times, from 2020-08-22 17:49:19 EEST to 2020-08-22 18:10:21 EEST
Aug 22 18:17:03  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 16 times, from 2020-08-22 18:12:03 EEST to 2020-08-22 18:12:03 EEST
Aug 22 18:17:03  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 17 times, from 2020-08-22 18:12:03 EEST to 2020-08-22 18:12:03 EEST
Aug 22 18:17:27  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  TTL:aggregate exceeded its allowed bandwidth at fpc 0 for 17 times, started at 2020-08-22 18:17:27 EEST
Aug 22 18:17:27  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  L3MTU-fail:aggregate exceeded its allowed bandwidth at fpc 0 for 18 times, started at 2020-08-22 18:17:27 EEST
Aug 22 18:17:32  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception RESOLVE:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 14 times, from 2020-08-22 18:10:21 EEST to 2020-08-22 18:12:27 EEST
Aug 22 18:19:38  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception IPMC-reserved:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 98 times, from 2020-08-22 18:11:42 EEST to 2020-08-22 18:14:37 EEST
Aug 22 18:22:28  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception TTL:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 17 times, from 2020-08-22 18:17:27 EEST to 2020-08-22 18:17:27 EEST
Aug 22 18:22:58  QFX5100 jddosd[1766]: DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception L3MTU-fail:aggregate has returned to normal. Its allowed bandwith was exceeded at fpc 0 for 18 times, from 2020-08-22 18:17:27 EEST to 2020-08-22 18:17:53 EEST

 

чтоб не создавать новую тему, напишу тут

в логах  QFX5100 большое количество сообщений DDOS_PROTOCOL_VIOLATION

время от времени падает связь по OSPF за стоящим за ним MX80

 

просьба подсказать куда копать _)

 

[orlik]

IPMC-reserved - bw по умолчанию 1500 pps, с большой вероятностью у вас там где-то петля по трафику. 

Попробуйте посмотреть "show ethernet-switching mac-learning-log | match move" на наличие mac-move, это для начала. Ну и перестроения STP топологии и прочее. Наличие большого кол-ва ttl-expired - говорит о петлях на l3 , либо это следствие от падения ospf, надо смотреть насколько часто падает ospf и как оно коррелирует с этими логами. 
L3MTU-fail - у вас разный MTU на линках ? в целом это может немного напрягать коробку если пытаться для каждого пакета генерить icmp mtu exceeded