From: Dennis J. Hartmann (dennisjhartmann@hotmail.com)
Date: Thu Sep 15 2005 - 15:36:12 GMT-3
I'm having the same issue with event dampening. 3 flaps in a 30
second half life and a suppress threshold of 2000 is IMPOSSIBLE to get the
interface to be dampened.
I was shutting the remote end and watching the debug output. As
soon as I saw some debug output generated from the shutdown, I re-enabled
the interface. As soon as that was detected, I did another shut down. I
repeated this down/up process 3 times and then immediately entered the show
interface dampening command. The penalty was only 1151 because the decay
timer is always running.
Based on this testing, I believe the proper suppress interval should
be 1000 to ensure that routes are suppressed if the half life MUST be 30
seconds and we MUST start dampening when there are 3 flaps.
Any comments on what would be construed as right for exam purposes,
would be GREATLY appreciated.
Sicnerely,
Dennis Hartmann
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Piotr Jelonek
Sent: Tuesday, July 05, 2005 3:51 PM
To: ccielab@groupstudy.com
Subject: IP Event dampening. Math problem.
Hi GS.
I've been testing IP dampening lately, especially one task:
Suppress interface if it flaps three times within 30 seconds.
My main concern is suppress-threshold value.
In order not to make it to complicated on the beginning I did try a simpler
version to check in my lab - suppressing if two flaps occur within 30
seconds.
dampening 30 300 1999 120
30 - most cumulative value that can be used 300 - doesn't matter in this
test
1999 - according to GS and some workbooks indications
that's the thing I'd like to discuss ;) 120 - doesn't matter in this
test
Pls notice that interface flapped two times within about 12 seconds and
interface wasn't suppressed.
---
Rack1R4(config-if)#do sh int fa0/0 dam
FastEthernet0/0
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
0 0 FALSE 0 30 300 1999 120 4800
Rack1R4(config-if)#sh
Rack1R4(config-if)#
09:51:49.911: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to
administratively down
09:51:50.912: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/0, changed state to down Rack1R4(config-if)#do sh int fa0/0
dam FastEthernet0/0
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
1 911 FALSE 0 30 300 1999 120 4800
Rack1R4(config-if)#no sh
09:51:56.958: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
09:51:59.534: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/0, changed state to up Rack1R4(config-if)#sh
09:52:01.538: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/0, changed state to down
09:52:04.431: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to
administratively down Rack1R4(config-if)#do sh int fa0/0 dam FastEthernet0/0
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
2 1513 FALSE 0 30 300 1999 120 4800
---
So I think the math here is not so simple like assumed - clock is ticking
all the time penalty get's lower every second. After two flaps within less
than 30 seconds interface didn't get suppressed like some assumed.
Back to my task: 3 flaps in 30 seconds for some math:
dampening 30 300 ???? 120
(As a flap I understand the moment when the interface goes down and gets
penalty, as xx I understand some value more then 0)
1.First scenario: three flaps in a row: 3000. Yep, here it's working
with 2999.
2.Second scenario: one flap, then after 29 seconds - two flaps in a row:
50x + 1000 = 250x
3.Third scenario: two flaps in a row, then after 29 seconds one flap:
10xx + 1000 = 20xx (a bit more then 2000) 4. Fourth scenario: one flap
every 15 seconds:
a. First flap. Time: GO. 1000 penalty.
b. 15 seconds later second flap: (1000 * 0.75) 750 + 1000 = 1750 c. 14.9
second later third flap: (1750 * 0.75 = 1312) 1312 + 1000 = 2312 d. Final
penalty accumulated after 30 seconds and 3 flaps: about 2312
I think that if I get task to suppress interface for 3 flaps within 30
seconds I'd go with suppress-threshold 2001 or even 2000. After two flaps in
a row I'll get max 2000, but it won't be exceeded so interface won't be
suppressed. If the third flap will come within this 30 seconds I'll be sure
it will count in.
Am I missing something ? Did I go too far ?
Or maybe I'm correct with my calculations ? Should I go with
suppress-threshold = 2000 to account 3 flaps within 30 seconds ?
Regards,
Piotr Jelonek
This archive was generated by hypermail 2.1.4 : Sun Oct 02 2005 - 14:40:15 GMT-3