Re: ip event dampening parameters

From: Godswill Oletu (oletu@inbox.lv)
Date: Fri May 19 2006 - 15:42:45 ART


Andrew,

Agreed, you are correct, but you are looking at it at the micro level, the
fact is, what you just explained is what will take place, the penalties are
decreased exponentially. But if we are to apply the half life and
exponential Decay formular, everybody will argue and nobody will do it,
because it will bring in alot of variations and that formular can be so
weary and long, that is why thinking macro will help resolve the problem.We
just close our eyes and make ourself to believe that, the penalty will only
be cut in half at the half life value.

If you want to apply, the half life exponential decay fornular I bet, you
will not be able to arrive at a concrete set of values that will "guarantee"
that the interface will be dampened at exactly 3 flaps within 30 sec.

Like in most things in mathematics and science, to retain our sanity, we are
allow to borrow, we are allow to summarize and to view things and make
assumptions at the micro level eg:

While is college, I have been in classes where the lecturer will be solving
equations, and at many points, we will substitute one complex equation into
another, and we will continue for tens of minutes solving this long
convoluting formula that will make you feel hungry and tire; at the end of
about one hour or more; we will hear the lecturer say "this value is so
Infinitesimally small that we can equate it to zero" before you know it,
various portion of that complex equation will start knocking themselves out,
until the final result is either zero (0) or one (1). We have "wasted" hours
just to proved that some set of complex convulating formulars are just zero
or one. And that is true, everything in science and mathematics and
networking too is either 1 or 0.

We all know that:
!
queue-list 1 queue 0 byte-count 2000
queue-list 1 queue 1 byte-count 3000
queue-list 1 queue 2 byte-count 1000
!

Is all a LIE, your interface is not sending exactly 2000 bytes for queue 0;
3000 bytes for queue 1 and 1000 bytes for queue 2. But at the macro level,
because we are allow to borrow or if you average the output for the
interface over an extended period of time; we will agree that it is on the
average sending at that level.

 But looking, analyzing and trying to understand it at the micro level can
be insane at times.

This is the formular for half exponential decay:

A=Aob^t (where 0 <b<1) or
A=Aoe^kt (where k is a negative number representing the rate of decay).
In both formulars Ao is the original amount present at time t=0.
(from: www.mathwords.com)

Who in his/her right senses will want to touch that formular with a long
stick before configuring dampening on an interface?

HTH
Godswill Oletu

----- Original Message -----
From: "Edwards, Andrew M" <andrew.m.edwards@boeing.com>
To: "Godswill Oletu" <oletu@inbox.lv>; "Koen Zeilstra"
<koen@koenzeilstra.com>; <ccielab@groupstudy.com>
Sent: Friday, May 19, 2006 12:18 PM
Subject: RE: ip event dampening parameters

I suggest you lab this up. With "dampen 30 1000 3000 60" the interface
will not dampen in 30 seconds with 3 flaps..

True, the half life is when the value is decayed by half its original
penalty. But since its an exponentially decaying algorithm, the penalty
begins decaying IMMEDIATELY.

What this means is, if you flap the interface with dampening (dampen 30
1000 3000 60) you will see the penalty at 1000 immediately, but then
querying the dampening for the interface again will indicate another
value like 893. And again, 773, etc. until at 30 seconds the value will
be 500 for the first flap.

If you flap it a second time then the penalty will be the original
decayed penalty value at that moment PLUS the new penalty value (e.g.
1000). And the exponential decay begins again. Query the interface and
you will see the penalty between 500 and 1500 and decaying fast. The
same holds true for a third flap.

In short, a suppress value of 3000, as configured, will not dampen the
interface with 3 flaps in 30 seconds because the cumulative penalty will
be < 3000 at the half-life; guaranteed!

HTH,

Andrew Edwards

CCIE #15334
Senior Network Engineer
562-797-4454 desk
800-946-4646 pin 6024349

-----Original Message-----
From: Godswill Oletu [mailto:oletu@inbox.lv]
Sent: Friday, May 19, 2006 6:53 AM
To: Koen Zeilstra; ccielab@groupstudy.com
Subject: Re: ip event dampening parameters

Koen,

Without going into alot of calculations, the answer to your original
question was straight forward and you were actually on the right path,
but instead of using a half life of 15 sec; a half life of 30 sec will
do the job..ie instead of:

>dampening 15 1000 3000 60

Using ....
!
interface fa0/0
dampening 30 1000 3000 60
!
Will be just fine...

The penalty for each flag is 1000 and that does not change and there is
no configurable parameter to change it. The above dampenning policy
simply
means:

* 1st flap, interface will get a penalty of 1000
* 2nd flap, the penalty will be 2000
* 3rd flap, the penalty will be 3000 and the interface will be dampened.

If the 2nd or 3rd flap occurred after 30 sec, the culmulative penalty
will be less than 3000 and the interface will not be dampened.

***Note, the original question states that "dampen the interface if it
flaps
3 times in 30 sec. period"

You see that, there will be no need to dampen the interface unless all
three flagings occur within 30 sec and since the half life is pegged at
30 sec, a penalty of 3000 accessed against 3 flaps is the key to
answering your original question.

You might want to say..."What if the 3rd flap happens at the 30th sec.?,
well this is open to a wide variety of interpretation, which, I believe
the question does not want to exploit, because if a flap took place at
the 30th sec, two things will happen; a penalty of 1000 will be
accessed, and the cumulative penalty will be cut in half, now which will
take place first (accessing a penalty of 1000 or cutting the culmulative
penalty by half)? As you can see, this is another thread of its own.

So 'dampening 30 1000 3000 60' is good enough, you can adjust the reuse
and max suppress vlaues, since the question is silent about them.

HTH
Godswill Oletu

----- Original Message -----
From: "Koen Zeilstra" <koen@koenzeilstra.com>
To: <ccielab@groupstudy.com>
Sent: Friday, May 19, 2006 4:31 AM
Subject: RE: ip event dampening parameters

> resent with original subject for clarity.
>
> -----------------------
> You look like a million dollars. All green and wrinkled.
>
> ---------- Forwarded message ----------
> Date: Fri, 19 May 2006 06:54:40 +0000 (UTC)
> From: Koen Zeilstra <koen@koenzeilstra.com>
> To: "Edwards, Andrew M" <andrew.m.edwards@boeing.com>
> Cc: Valentijn van Veen <valentijn@icando.nl>, ccielab@groupstudy.com
> Subject: Re: your mail
>
> Hi,
>
> It's getting clearer by the minute fortunately.
>
> However the cummulative value of the second flap penalty should be
1500 <
> B < 2500. Since if it happens at t=30 (halftime) it is at its
> lowest (500 + 1000 = 1500). And right after the first flap: 1000 +
1000 =
> 2000.
>
> So within the 30 seconds another flap would be anything about 2000.
That
> makes again dampening 30 with default 2000 as suppress value the best
> option.
>
> thanks,
>
> Koen
>
>
>
> On Thu, 18 May 2006, Edwards, Andrew M wrote:
>
> | Think of it this way... We know each flap is a penalty of 1000.
So...
> |
> | The first flap is a penalty of 1000. With a half life of 30 seconds
the
> | maximum penalty for the first flap at time = 30 sec. is 500. Let
A=500
> |
> | The second flap is sometime between time =0 and time =30. So we can
> | deduce that the penalty from the second flap will be greater than
500 at
> | the 30 second mark but less than 1000. The second flap penalty
value is
> | represented by B. We can safely say that 500 <= B <= 1000
> |
> | The third flap is sometime between the second flap and time = 30.
So we
> | can again deduce that the penalty from the third flap will be
greater
> | than 500 at the 30 second mark but less than 1000. The third flap
> | penalty value is represented by C. Again, we can safely say that
500 <=
> | C <= 1000
> |
> | What do we know then? We know that A = 500. We also know that B
and C
> | cannot be any larger than 500.
> |
> | So the LOWEST total accumulated penalty in this scenario by equation
is:
> |
> | F(x) >= A+B+C.
> | F(x) >= 500 + 500 + 500.
> | F(x) >= 1500
> |
> | IOW, the SMALLEST accumulated penalty with a 30 second half life is
> | 1500.
> |
> | If we use "dampen 30", then the default suppress value is 2000.
> |
> | Since we cannot say with certainty that the penalty is >= 2000; and
I
> | don't want to memorize the equation for exponential decay, we must
> | change the default suppress penalty to a number >= 1500.
> |
> | That, or memorize the exponential decay function. 8)
> |
> |
> | Andrew Edwards
> | <<Picture (Metafile)>>
> | CCIE #15334
> | Senior Network Engineer
> | 562-797-4454 desk
> | 800-946-4646 pin 6024349
> |
> |
> |
>
>



This archive was generated by hypermail 2.1.4 : Thu Jun 01 2006 - 06:33:22 ART