DDoS Rate Limiting for Telemetry Traffic
Junos OS Evolved supports DDoS rate limiting for telemetry traffic to enhance host path protection and provide improved control over telemetry traffic volume. Telemetry TCP traffic is classified as unclassified. TCP acknowledgment (ACK) packets from the telemetry collector to the device are affected by other unclassified traffic and dropped by the shared DDoS policer. With this enhancement, telemetry is mapped as a dedicated DDoS protocol. This enables targeted rate limiting, bandwidth control, and traffic monitoring, and ensures that telemetry TCP ACK traffic is not affected by other unclassified traffic. The telemetry server IP address (optional, depending on configuration) and TCP port (mandatory) are used as match terms by the DDoS filter for telemetry traffic.
This feature is supported on the PTX10003 devices.
DDoS rate limiting is implemented on a packets-per-second basis and is independent of packet size. The telemetry DDoS policer applies only to ingress traffic and rate-limits TCP acknowledgment (ACK) packets from the collector to the device. This feature applies only to TCP-based telemetry traffic and does not support UDP telemetry traffic. Existing DDoS configuration options, including FPC-level settings and disablement behavior, remain consistent with other DDoS protocol configurations.
You can subscribe to the /junos/system/linecard/ddos/ resource path to stream DDoS statistics.
To configure DDoS Protection, see Configuring Control Plane DDoS Protection.
Enable DDoS protection using the ddos-protection command. Configure telemetry as the protocol for aggregate TCP telemetry packets using the protocols (DDoS) (ACX Series, PTX Series, and QFX Series) option. You can also configure the bandwidth (default: 25000 packets per second) and the burst size (default: 25000) for telemetry traffic. For example:
edit system ddos-protection protocols telemetry aggregate bandwidth
25000 burst 25000
Verify the configuration using the show ddos-protection protocols command. For example:
show ddos-protection protocols telemetry
Sample output:
user@host> show ddos-protection protocols telemetry
Packet types: 1, Modified: 0, Received traffic: 0, Currently violated: 0
Currently tracked flows: 0, Total detected flows: 0
* = User configured value
Protocol Group: TELEMETRY
Packet type: aggregate (Aggregate for all telemetry traffic)
Aggregate policer configuration:
Bandwidth: 25000 pps
Burst: 25000 packets
Priority: High
Recover time: 300 seconds
Enabled: Yes
System-wide information:
Aggregate bandwidth is never violated
Received: 0 Arrival rate: 0 pps
Dropped: 0 Max arrival rate: 0 pps
Routing Engine information:
Bandwidth: 25000 pps, Burst: 25000 packets, enabled
Aggregate policer is never violated
Received: 0 Arrival rate: 0 pps
Dropped: 0 Max arrival rate: 0 pps
Dropped by individual policers: 0
FPC slot 0 information:
Bandwidth: 100% (25000 pps), Burst: 100% (25000 packets), enabled
Aggregate policer is never violated
Received: 0 Arrival rate: 0 pps
Dropped: 0 Max arrival rate: 0 pps
Dropped by individual policers: 0
Dropped by flow suppression: 0