From: Piotr Jelonek (piotr@jelonek.info)
Date: Tue Jul 05 2005 - 16:51:18 GMT-3
Hi GS.
I've been testing IP dampening lately, especially one task:
Suppress interface if it flaps three times within 30 seconds.
My main concern is suppress-threshold value.
In order not to make it to complicated on the beginning I did try
a simpler version to check in my lab - suppressing if two flaps occur
within 30 seconds.
dampening 30 300 1999 120
30 - most cumulative value that can be used
300 - doesn't matter in this test
1999 - according to GS and some workbooks indications
that's the thing I'd like to discuss ;)
120 - doesn't matter in this test
Pls notice that interface flapped two times within about 12 seconds and
interface wasn't suppressed.
---
Rack1R4(config-if)#do sh int fa0/0 dam
FastEthernet0/0
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
0 0 FALSE 0 30 300 1999 120 4800
Rack1R4(config-if)#sh
Rack1R4(config-if)#
09:51:49.911: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state
to administratively down
09:51:50.912: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/0, changed state to down
Rack1R4(config-if)#do sh int fa0/0 dam
FastEthernet0/0
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
1 911 FALSE 0 30 300 1999 120 4800
Rack1R4(config-if)#no sh
09:51:56.958: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state
to up
09:51:59.534: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/0, changed state to up
Rack1R4(config-if)#sh
09:52:01.538: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/0, changed state to down
09:52:04.431: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state
to administratively down
Rack1R4(config-if)#do sh int fa0/0 dam
FastEthernet0/0
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
2 1513 FALSE 0 30 300 1999 120 4800
---
So I think the math here is not so simple like assumed - clock is
ticking all the time penalty get's lower every second. After two flaps
within less than 30 seconds interface didn't get suppressed like some assumed.
Back to my task: 3 flaps in 30 seconds for some math:
dampening 30 300 ???? 120
(As a flap I understand the moment when the interface goes down and gets
penalty, as xx I understand some value more then 0)
1.First scenario: three flaps in a row: 3000. Yep, here it's working
with 2999.
2.Second scenario: one flap, then after 29 seconds - two flaps in a row:
50x + 1000 = 250x
3.Third scenario: two flaps in a row, then after 29 seconds one flap:
10xx + 1000 = 20xx (a bit more then 2000)
4. Fourth scenario: one flap every 15 seconds:
a. First flap. Time: GO. 1000 penalty.
b. 15 seconds later second flap: (1000 * 0.75) 750 + 1000 = 1750
c. 14.9 second later third flap: (1750 * 0.75 = 1312) 1312 + 1000 = 2312
d. Final penalty accumulated after 30 seconds and 3 flaps: about 2312
I think that if I get task to suppress interface for 3 flaps within 30
seconds I'd go with suppress-threshold 2001 or even 2000. After two flaps
in a row I'll get max 2000, but it won't be exceeded so interface won't be
suppressed. If the third flap will come within this 30 seconds I'll be
sure it will count in.
Am I missing something ? Did I go too far ?
Or maybe I'm correct with my calculations ? Should I go with
suppress-threshold = 2000 to account 3 flaps within 30 seconds ?
Regards,
Piotr Jelonek
This archive was generated by hypermail 2.1.4 : Sun Sep 04 2005 - 17:00:29 GMT-3