IGMP messages carry the router alert option, and as with all exception traffic
are throttled in the pfe to prevent excess PFE cpu and PFE-RE bw consumption,
as you surmise. I believe the default setting is ~ 25 PPS, and is not user
configurable. IIRC, on distributed PFE systems such as a T-series this is per
pfe, so you can get an aggregate rate that is higher. Perhaps this explains
your numbers.
I believe you can confirm by displaying pfe notification stats, which should
count rate limit discards.
HTHs
regr...@vpn02> show pfe statistics notification
PFE Notification statistics:
183466 parsed
0 aged
0 corrupt
0 illegal
0 sample
0 giants
0 transit options/ttl-exceeded (re-injected)
0 transit options/ttl-exceeded errors
0 svc options sent to ASP
0 svc options sent to RE
0 post svc options sent out
0 options or ttl expired (not RE-destined)
0 discard sample
0 rate limited
^^^^^^^^^^^^^^^^^^^^^^^^^^^
0 packet get failure
0 DMA failure
0 Total DMa'd packets
0 Unknown/unclassified packets
PFE Notification Type statistics:
Parsed Input Failed Ignored
Illegal 0 0 0 0
Unclass 0 0 0 0
Option 2858 2858 0 0
Next-Hop 180608 180608 0 0
Discard 0 0 0 0
Sample 0 0 0 0
Redirect 0 0 0 0
DontFrag 0 0 0 0
CfDF 0 0 0 0
Poison 0 0 0 0
Unknown 0 0 0 0
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Judah Scott
Sent: Tuesday, August 04, 2009 6:56 PM
To: [email protected]
Subject: [j-nsp] IGMP Join Rate Limiting
When testing IGMP join rates I see an unusual rate of ~500pps. In an example I
look at interface stats and see 1000 packets in, 539 input to local, 461 input
to transit. Corresponding to this I see 539 IGMP groups setup. If I burst the
same range again in the next second I don't learn any more. If I burst a new
range of joins then these will go through.
This leads me to believe that there is some filter or DOS protection for
multicast packets because looking at the CPU I only see ~10% utilization. I
only see the default arp l2-policer being applied on this interface. Does
anyone have experience with DOS protection in JUNOS?
Thanks,
J Scott
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
