Support Support Downloads Knowledge Base Apex Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[QFX] Transit L2 traffic seen on CPU in QFX5100



Article ID: KB31281 KB Last Updated: 29 Nov 2016Version: 1.0

When using tcpdump from the shell or ‘monitor traffic interface <interface-name>’, transit traffic is seen on the CPU even if the device acts as a pure L2 switch.

This occurs when the following conditions are met:
  1. Dest Mac = Multicast MAC[47:23] = 0x01005e
  2. Both IPv4 or IPv6 multicast Layer 3 reserved addresses only
In this case, packets will be punted to CPU and forwarded in the Fast path.


00:00:00:00:ae:05 > 01:00:5e:10:1b:aa, ethertype 802.1Q (0x8100), length 80: vlan 150, p 0, ethertype IPv4, (tos 0x0, ttl 255, id 0, offset 0, flags [none], proto: UDP (17), length: 62) > [udp sum ok] UDP, length 34 20:22:29.265785 In

In IP6 fe80::8baa:e200:155:a32 > ff02::5: OSPFv3, Hello, length 40
In IP6 fe80::8baa:e200:5e55:a32 > ff02::5: OSPFv3, Hello, length 40

For the above IPv4 and IPv6 packet type, the rule applies and they are copied to RE and forwarded as well. This does not apply to regular non reserved multicast addresses.


This behavior is by design. Packets are copied to the CPU even before the firewall.

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search