From: Chris Lewis (chrlewiscsco@gmail.com)
Date: Fri May 19 2006 - 16:45:13 ART
Dear All:
I think this discussion is making it far more complex than need be.
IMHO one cannot ignire the fact that it is an exponential decay mechanism in
order to answer this question.
The question asks that if three flaps occur within 30 seconds, the interface
will be dampened. This is troublesome as it does not tell you at what times
those flaps occur, which is a pretty important piece of information. So the
way to read it is to ask yourself what parameters will cause the interface
to be dampened no matter what the spacing of the flaps is?
I would suggest that
dampening 30
Or something close to it, is all you need configure
The penalty is always 1000, and the suppress limit is 2000 at default. Look
at what happens in these use cases.
If three flaps occur evenly spaced every 14 seconds. At t=0, the first flap,
the penalty is 1000, after 14 seconds, it will have decayed to something
around 750 (this is not exact), at t=14 the next flap happens and the
penalty is now 1750, at t=28 this decays to something a little over 1000 and
the next flap occurs to take it over 2000 to suppress the interface.
If two flaps happen within the first second the penalty goes up very close
to 2000, say 28 seconds later than the penalty will be coming down close to
1000, then the third flap occurs to take the penalty over 2000 to have it
suppressed.
A case where two flaps happen at the start of 30 seconds and the third at
the end of 30 seconds is illustrated with the following configuration and
debug.
R2(config-if)#dampening 30
R2(config-if)#^Z
R2#deb
*Mar 1 18:03:22.903: %SYS-5-CONFIG_I: Configured from console by console
damp int
interface debugging is on
R2#
*Mar 1 18:03:48.867: %LINK-3-UPDOWN: Interface Serial0/1, changed state to
down
*Mar 1 18:03:48.867: IF-EvD(Serial0/1): IP Routing reports state transition
from UP to DOWN
*Mar 1 18:03:48.867: EvD(Serial0/1): charge penalty 1000, new accum.
penalty 1000, flap count 1
*Mar 1 18:03:48.867: EvD(Serial0/1): accum. penalty 1000, not suppressed
*Mar 1 18:03:48.867: IF-EvD(Serial0/1): update IP Routing state to DOWN,
interface is not suppressed
*Mar 1 18:03:49.867: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Serial0/1, changed state to down
*Mar 1 18:03:49.867: IF-EvD(Serial0/1): IP Routing reports state transition
from DOWN to DOWN
*Mar 1 18:03:54.187: %LINK-3-UPDOWN: Interface Serial0/1, changed state to
up
*Mar 1 18:03:54.187: IF-EvD(Serial0/1): IP Routing reports state transition
from DOWN to UP
*Mar 1 18:03:54.187: IF-EvD(Serial0/1): update IP Routing state to UP,
interface is not suppressed
*Mar 1 18:03:55.187: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Serial0/1, changed state to up
*Mar 1 18:03:55.187: IF-EvD(Serial0/1): IP Routing reports state transition
from UP to UP
*Mar 1 18:03:59.663: %LINK-3-UPDOWN: Interface Serial0/1, changed state to
down
*Mar 1 18:03:59.663: IF-EvD(Serial0/1): IP Routing reports state transition
from UP to DOWN
*Mar 1 18:03:59.663: EvD(Serial0/1): accum. penalty decayed to 793 after 10
second(s)
*Mar 1 18:03:59.663: EvD(Serial0/1): charge penalty 1000, new accum.
penalty 1793, flap count 2
*Mar 1 18:03:59.663: EvD(Serial0/1): accum. penalty 1793, not suppressed
*Mar 1 18:03:59.663: IF-EvD(Serial0/1): update IP Routing state to DOWN,
interface is not suppressed
*Mar 1 18:04:00.663: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Serial0/1, changed state to down
*Mar 1 18:04:02.399: %LINK-3-UPDOWN: Interface Serial0/1, changed state to
up
*Mar 1 18:04:02.399: IF-EvD(Serial0/1): IP Routing reports state transition
from DOWN to UP
*Mar 1 18:04:02.399: IF-EvD(Serial0/1): update IP Routing state to UP,
interface is not suppressed
*Mar 1 18:04:03.399: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Serial0/1, changed state to up
*Mar 1 18:04:03.399: IF-EvD(Serial0/1): IP Routing reports state transition
from UP to UP
*Mar 1 18:04:17.171: %LINK-3-UPDOWN: Interface Serial0/1, changed state to
down
*Mar 1 18:04:17.171: IF-EvD(Serial0/1): IP Routing reports state transition
from UP to DOWN
*Mar 1 18:04:17.171: EvD(Serial0/1): accum. penalty decayed to 1182 after
18 second(s)
*Mar 1 18:04:17.171: EvD(Serial0/1): charge penalty 1000, new accum.
penalty 2182, flap count 3
*Mar 1 18:04:17.171: EvD(Serial0/1): accum. penalty 2182, now suppressed
with a reuse intervals of 34
*Mar 1 18:04:17.171: IF-EvD(Serial0/1): update IP Routing state to DOWN,
interface is suppressed
*Mar 1 18:04:18.171: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Serial0/1, changed state to down
*Mar 1 18:04:19.283: %LINK-3-UPDOWN: Interface Serial0/1, changed state to
up
*Mar 1 18:04:19.283: IF-EvD(Serial0/1): IP Routing reports state transition
from DOWN to UP
*Mar 1 18:04:20.283: %LINEPROTO-5-UPDOWN: Line protocol on Interface
Serial0/1, changed state to up
*Mar 1 18:04:20.283: IF-EvD(Serial0/1): IP Routing reports state transition
from UP to UP
R2#sho int damp
Serial0/1
Flaps Penalty Supp ReuseTm HalfL ReuseV SuppV MaxSTm MaxP
Restart
3 1282 TRUE 11 30 1000 2000 120
16000 0
R2#
*Mar 1 18:04:39.911: EvD(Serial0/1): accum. penalty decayed to 1282 after
23 second(s)
*Mar 1 18:04:51.171: IF-EvD: unsuppress interfaces
*Mar 1 18:04:52.171: IF-EvD: unsuppress interfaces
*Mar 1 18:04:52.171: EvD(Serial0/1): accum. penalty decayed to 971 after 12
second(s)
*Mar 1 18:04:52.171: EvD(Serial0/1): accum. penalty 971, now unsuppressed
*Mar 1 18:04:52.171: IF-EvD(Serial0/1): update IP Routing state to UP,
interface is not suppressed
THis shows teh interface being suppressed after the third flap, then 1
minute thirty seconds after teh first flap, the link is unsuppressed when
the penalty falls below the default 100 figure.
Chris
On 5/19/06, Godswill Oletu <oletu@inbox.lv> wrote:
>
> Andrew,
>
> Agreed, you are correct, but you are looking at it at the micro level, the
> fact is, what you just explained is what will take place, the penalties
> are
> decreased exponentially. But if we are to apply the half life and
> exponential Decay formular, everybody will argue and nobody will do it,
> because it will bring in alot of variations and that formular can be so
> weary and long, that is why thinking macro will help resolve the
> problem.We
> just close our eyes and make ourself to believe that, the penalty will
> only
> be cut in half at the half life value.
>
> If you want to apply, the half life exponential decay fornular I bet, you
> will not be able to arrive at a concrete set of values that will
> "guarantee"
> that the interface will be dampened at exactly 3 flaps within 30 sec.
>
> Like in most things in mathematics and science, to retain our sanity, we
> are
> allow to borrow, we are allow to summarize and to view things and make
> assumptions at the micro level eg:
>
> While is college, I have been in classes where the lecturer will be
> solving
> equations, and at many points, we will substitute one complex equation
> into
> another, and we will continue for tens of minutes solving this long
> convoluting formula that will make you feel hungry and tire; at the end of
> about one hour or more; we will hear the lecturer say "this value is so
> Infinitesimally small that we can equate it to zero" before you know it,
> various portion of that complex equation will start knocking themselves
> out,
> until the final result is either zero (0) or one (1). We have "wasted"
> hours
> just to proved that some set of complex convulating formulars are just
> zero
> or one. And that is true, everything in science and mathematics and
> networking too is either 1 or 0.
>
> We all know that:
> !
> queue-list 1 queue 0 byte-count 2000
> queue-list 1 queue 1 byte-count 3000
> queue-list 1 queue 2 byte-count 1000
> !
>
> Is all a LIE, your interface is not sending exactly 2000 bytes for queue
> 0;
> 3000 bytes for queue 1 and 1000 bytes for queue 2. But at the macro level,
> because we are allow to borrow or if you average the output for the
> interface over an extended period of time; we will agree that it is on the
> average sending at that level.
>
> But looking, analyzing and trying to understand it at the micro level can
> be insane at times.
>
> This is the formular for half exponential decay:
>
> A=Aob^t (where 0 <b<1) or
> A=Aoe^kt (where k is a negative number representing the rate of decay).
> In both formulars Ao is the original amount present at time t=0.
> (from: www.mathwords.com)
>
> Who in his/her right senses will want to touch that formular with a long
> stick before configuring dampening on an interface?
>
> HTH
> Godswill Oletu
>
> ----- Original Message -----
> From: "Edwards, Andrew M" <andrew.m.edwards@boeing.com>
> To: "Godswill Oletu" <oletu@inbox.lv>; "Koen Zeilstra"
> <koen@koenzeilstra.com>; <ccielab@groupstudy.com>
> Sent: Friday, May 19, 2006 12:18 PM
> Subject: RE: ip event dampening parameters
>
>
> I suggest you lab this up. With "dampen 30 1000 3000 60" the interface
> will not dampen in 30 seconds with 3 flaps..
>
> True, the half life is when the value is decayed by half its original
> penalty. But since its an exponentially decaying algorithm, the penalty
> begins decaying IMMEDIATELY.
>
> What this means is, if you flap the interface with dampening (dampen 30
> 1000 3000 60) you will see the penalty at 1000 immediately, but then
> querying the dampening for the interface again will indicate another
> value like 893. And again, 773, etc. until at 30 seconds the value will
> be 500 for the first flap.
>
> If you flap it a second time then the penalty will be the original
> decayed penalty value at that moment PLUS the new penalty value (e.g.
> 1000). And the exponential decay begins again. Query the interface and
> you will see the penalty between 500 and 1500 and decaying fast. The
> same holds true for a third flap.
>
> In short, a suppress value of 3000, as configured, will not dampen the
> interface with 3 flaps in 30 seconds because the cumulative penalty will
> be < 3000 at the half-life; guaranteed!
>
> HTH,
>
> Andrew Edwards
>
> CCIE #15334
> Senior Network Engineer
> 562-797-4454 desk
> 800-946-4646 pin 6024349
>
>
> -----Original Message-----
> From: Godswill Oletu [mailto:oletu@inbox.lv]
> Sent: Friday, May 19, 2006 6:53 AM
> To: Koen Zeilstra; ccielab@groupstudy.com
> Subject: Re: ip event dampening parameters
>
> Koen,
>
> Without going into alot of calculations, the answer to your original
> question was straight forward and you were actually on the right path,
> but instead of using a half life of 15 sec; a half life of 30 sec will
> do the job..ie instead of:
>
> >dampening 15 1000 3000 60
>
> Using ....
> !
> interface fa0/0
> dampening 30 1000 3000 60
> !
> Will be just fine...
>
> The penalty for each flag is 1000 and that does not change and there is
> no configurable parameter to change it. The above dampenning policy
> simply
> means:
>
> * 1st flap, interface will get a penalty of 1000
> * 2nd flap, the penalty will be 2000
> * 3rd flap, the penalty will be 3000 and the interface will be dampened.
>
> If the 2nd or 3rd flap occurred after 30 sec, the culmulative penalty
> will be less than 3000 and the interface will not be dampened.
>
> ***Note, the original question states that "dampen the interface if it
> flaps
> 3 times in 30 sec. period"
>
> You see that, there will be no need to dampen the interface unless all
> three flagings occur within 30 sec and since the half life is pegged at
> 30 sec, a penalty of 3000 accessed against 3 flaps is the key to
> answering your original question.
>
> You might want to say..."What if the 3rd flap happens at the 30th sec.?,
> well this is open to a wide variety of interpretation, which, I believe
> the question does not want to exploit, because if a flap took place at
> the 30th sec, two things will happen; a penalty of 1000 will be
> accessed, and the cumulative penalty will be cut in half, now which will
> take place first (accessing a penalty of 1000 or cutting the culmulative
> penalty by half)? As you can see, this is another thread of its own.
>
> So 'dampening 30 1000 3000 60' is good enough, you can adjust the reuse
> and max suppress vlaues, since the question is silent about them.
>
> HTH
> Godswill Oletu
>
>
> ----- Original Message -----
> From: "Koen Zeilstra" <koen@koenzeilstra.com>
> To: <ccielab@groupstudy.com>
> Sent: Friday, May 19, 2006 4:31 AM
> Subject: RE: ip event dampening parameters
>
>
> > resent with original subject for clarity.
> >
> > -----------------------
> > You look like a million dollars. All green and wrinkled.
> >
> > ---------- Forwarded message ----------
> > Date: Fri, 19 May 2006 06:54:40 +0000 (UTC)
> > From: Koen Zeilstra <koen@koenzeilstra.com>
> > To: "Edwards, Andrew M" <andrew.m.edwards@boeing.com>
> > Cc: Valentijn van Veen <valentijn@icando.nl>, ccielab@groupstudy.com
> > Subject: Re: your mail
> >
> > Hi,
> >
> > It's getting clearer by the minute fortunately.
> >
> > However the cummulative value of the second flap penalty should be
> 1500 <
> > B < 2500. Since if it happens at t=30 (halftime) it is at its
> > lowest (500 + 1000 = 1500). And right after the first flap: 1000 +
> 1000 =
> > 2000.
> >
> > So within the 30 seconds another flap would be anything about 2000.
> That
> > makes again dampening 30 with default 2000 as suppress value the best
> > option.
> >
> > thanks,
> >
> > Koen
> >
> >
> >
> > On Thu, 18 May 2006, Edwards, Andrew M wrote:
> >
> > | Think of it this way... We know each flap is a penalty of 1000.
> So...
> > |
> > | The first flap is a penalty of 1000. With a half life of 30 seconds
> the
> > | maximum penalty for the first flap at time = 30 sec. is 500. Let
> A=500
> > |
> > | The second flap is sometime between time =0 and time =30. So we can
> > | deduce that the penalty from the second flap will be greater than
> 500 at
> > | the 30 second mark but less than 1000. The second flap penalty
> value is
> > | represented by B. We can safely say that 500 <= B <= 1000
> > |
> > | The third flap is sometime between the second flap and time = 30.
> So we
> > | can again deduce that the penalty from the third flap will be
> greater
> > | than 500 at the 30 second mark but less than 1000. The third flap
> > | penalty value is represented by C. Again, we can safely say that
> 500 <=
> > | C <= 1000
> > |
> > | What do we know then? We know that A = 500. We also know that B
> and C
> > | cannot be any larger than 500.
> > |
> > | So the LOWEST total accumulated penalty in this scenario by equation
> is:
> > |
> > | F(x) >= A+B+C.
> > | F(x) >= 500 + 500 + 500.
> > | F(x) >= 1500
> > |
> > | IOW, the SMALLEST accumulated penalty with a 30 second half life is
> > | 1500.
> > |
> > | If we use "dampen 30", then the default suppress value is 2000.
> > |
> > | Since we cannot say with certainty that the penalty is >= 2000; and
> I
> > | don't want to memorize the equation for exponential decay, we must
> > | change the default suppress penalty to a number >= 1500.
> > |
> > | That, or memorize the exponential decay function. 8)
> > |
> > |
> > | Andrew Edwards
> > | <<Picture (Metafile)>>
> > | CCIE #15334
> > | Senior Network Engineer
> > | 562-797-4454 desk
> > | 800-946-4646 pin 6024349
> > |
> > |
> > |
> >
> >
> _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
> >
> >
> _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Thu Jun 01 2006 - 06:33:22 ART