In reply to (a little bit late :-): https://puck.nether.net/pipermail/juniper-nsp/2009-May/013325.html
I have done some testing with M7i and Junos 9.5R2 and simulated ARP-FLOOD attack. No protection on the M7i. Attack generates ~8500000 arp requests in 180 secs which makes roughly 48000 arp-req/sec =~ 23mbps The internal policer dropped almost all of them: l...@r4> show policer Policers: Name Packets __default_arp_policer__ 8493207 and only ~40000 arp requests received a reply from M7i which makes roughly ~222 arp-reply/sec During the attack the CPU raised of ~14%. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ My conclusion is that the setting for __default_arp_policer__ are perfectly fine and there is no need to apply a custom arp policer to any interface. What is the opinion of the experts over there? Bit. _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
