From: Ivan (ivan@iip.net)
Date: Sun Nov 19 2006 - 09:09:39 ART
Briefly about M flapps in N seconds can be expressed next formula.
half-life time = N sec
penalty = 1000
suppress value = (M + 1) * penalty / 2 [+/-1]
Let calculate both extremums minimum and maximum.
Minimum) Suppose (M-1) flaps appear during first second, then penalty will
(M-1)*penalty. After half-life time penalty will (M - 1) * penalty / 2.
Last flap appear on the last second (+ penalty). Totally last compound penalty
will (M - 1) * penalty / 2 + penalty = (M + 1) * penalty / 2
Maximum) All flaps appear at the same time. M * penalty.
Difference betweeen this values (M-1)/2*penalty. This difference is always > 0
f M > 1 (ie flap count above one).
[+/- 1]) it is the same as 16:59 and 17:00 discussion can be founded in GS.
Suppressed value must be minimum of these values: min((M+1)*pen/2, M*pen)
if(M == 1) both value equal
if(M > 1) (M+1)*pen/2
Verify:
1) "2 flaps in 15 sec"
half-life time = 15 sec
penalty = 1000
suppress value = (2 + 1) * 1000 / 2 = 1500 [+/- 1]
2) "3 flaps in 30 secs"
half-life time = 30 sec
penalty = 1000
suppress value = (3 + 1) * 1000 / 2 = 2000 [+/- 1]
On Sunday 19 November 2006 14:05, Alexei Monastyrnyi wrote:
> Folks,
> just to share quickly my train of thoughts here.
>
> 1. "2 flaps in 15 secs" - dampen 15 1000 1500 60
> As is was correctly noticed before, half-time starts counting down
> immediately and accumulated penalty starts decreases right after flap
> happens as well. In this situation we consider events in time frame
> after the first flap and during this time frame (watching period) "15
> secs" the second flap should gain accumulated penalty that hits the
> suppress threshold, whenever it happens. Two extremes here - right after
> the first flap and right before "15 secs". With the first extreme
> accumulated penalty is near 2000 (two time penalty). With the second
> one, it all depends on half-time. If we put "15" as a half-time, by the
> end of watching "15 secs" period (which in this case happens to be the
> same as half-time) accumulated penalty for the second extreme is as low
> as 1500. So we pick 1500 for the suppress threshold. All the rest should
> go to defaults (max-time should keep default ration).
>
> 2. "3 times in 30 secs" - dampen 30
> Will try to cut it short here, assuming you follow my logic from (1).
> Again we count down after the first flap and when watching period "30
> secs" starts we have accumulated penalty 1000. During this watching
> period next two flaps (second and third) should gain accumulated penalty
> above suppress threshold. Again, two extremes here - the second flap
> happens right after the first one and the third one happens at the very
> end of watching period; or both second and third flap happen at the very
> end of watching period of 30 secs. To make myself an absolute bore in
> your eyes, I would say that it is easy to see that all other situations
> are covered by these two extremes. :-). Now it all depends on half-time
> (and suppress threshold). Taking half-time 30 secs we have the following.
>
> With the first extreme we gain accumulated penalty nearly (but not more
> than) 2000 at the beginning of watching period, counting down,
> decreasing stuff and have it nearly (but not less than) 1000 (remaining
> penalty) + 1000 (for the third flap) = nearly 2000 by the end of
> watching period.
>
> With the second extreme we gain not less than 500 (remaining penalty) by
> the end of watching period + 2000 (two flaps) = nearly2500.
>
> Now we choose minimum among 2000 and 2500, it happens to be a default
> value 2000.
>
> 2001 would not suit well, cause in worst case we gain nearly (but no
> more than) 2000. I wold pick 1999 :-) but as Scott said the other day
> with regard to time-range ending 16:59 vs 17:00, they shouldn't be that
> picky, i.e. one should show the knowledge, rather than ability to
> memorize stuff. :-)
>
> IMO the first case shows more knowledge cause one cannot use defaults
> there, with there second one it is easy to memorize. So it could be
> thought as "easy 3 points" or "hard 3 points" to get on the lab. :-)
>
> Sorry if my post took too much time and energy to get through. :-) It
> would be actually interesting to research a more general task "M flaps
> in N secs". But not this time. :-)
>
> Have a good one,
> A.
>
> Scott Morris wrote:
> > IMHO, I'd pick a suppress value of 1 more than 2x the penalty in this
> > case. Instead of 3000, use 2001. Even sliding down, statistically with 3
> > flaps in 30 seconds, no matter where on the scale of half-life you are,
> > that will always work.
> >
> > HTH,
> >
> >
> > Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE
> > #153, CISSP, et al.
> > CCSI/JNCI-M/JNCI-J
> > IPExpert VP - Curriculum Development
> > IPExpert Sr. Technical Instructor
> > smorris@ipexpert.com
> > http://www.ipexpert.com
> >
> >
> >
> > -----Original Message-----
> > From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
> > anthony.sequeira@thomson.com
> > Sent: Saturday, November 18, 2006 2:02 AM
> > To: dukelondon@gmail.com
> > Cc: hitesh@att.com; ccielab@groupstudy.com
> > Subject: RE: IP Event Dampening
> >
> > I labbed this one up as this post suggests and learned that he was indeed
> > correct about how the penalty moves....I am so sorry that I do not have
> > time right now to research the definitive answer <again> - but I think
> > you should have all the info you need now to ensure that you will get the
> > dampening behavior required given certain values.
> >
> >
> >
> > I suggest you lab this up. With "dampen 30 1000 3000 60" the interface
> > will not dampen in 30 seconds with 3 flaps..
> >
> > True, the half life is when the value is decayed by half its original
> > penalty. But since its an exponentially decaying algorithm, the penalty
> > begins decaying IMMEDIATELY.
> >
> > What this means is, if you flap the interface with dampening (dampen 30
> > 1000 3000 60) you will see the penalty at 1000 immediately, but then
> > querying the dampening for the interface again will indicate another
> > value like 893. And again, 773, etc. until at 30 seconds the value will
> > be 500 for the first flap.
> >
> > If you flap it a second time then the penalty will be the original
> > decayed penalty value at that moment PLUS the new penalty value (e.g.
> > 1000). And the exponential decay begins again. Query the interface and
> > you will see the penalty between 500 and 1500 and decaying fast. The
> > same holds true for a third flap.
> >
> > In short, a suppress value of 3000, as configured, will not dampen the
> > interface with 3 flaps in 30 seconds because the cumulative penalty will
> > be < 3000 at the half-life; guaranteed!
> >
> >
> >
> >
> > ________________________________
> >
> > From: Salman Abbas [mailto:dukelondon@gmail.com]
> > Sent: Saturday, November 18, 2006 1:40 AM
> > To: Sequeira, Anthony (NETg)
> > Cc: hitesh@att.com; ccielab@groupstudy.com
> > Subject: Re: IP Event Dampening
> >
> >
> >
> > Hi Hitesh,
> >
> >
> >
> > Thanks a bunch bro.
> >
> >
> > Hi Anthony,
> >
> >
> >
> > Thanks for the thread but what should the answer be, taking Hitesh's
> > reply and the thread into consideration?
> >
> > I mean dampening 15 1000 ___ 60 .
> >
> >
> >
> > Pls advise,
> >
> >
> >
> > Thanks and Regards,
> >
> >
> > Salman
> >
> >
> >
> > On 11/18/06, anthony.sequeira@thomson.com <anthony.sequeira@thomson.com
> >
> >> wrote:
> >
> > Careful - this feature does not work like you think - here is an
> > excellent thread from the archives on the subject. . . note that the
> > biggest surprise is how the feature uses an exponentially decaying
> > algorithm - jeez.....
> >
> > http://adserver.groupstudy.com/archives/ccielab/200605/msg01011.html
> >
> > Anthony J. Sequeira
> > #15626
> >
> >
> > -----Original Message-----
> > From: nobody@groupstudy.com [mailto:nobody@groupstudy.com ] On Behalf Of
> > SAVJANI, HITESH, WWCS
> > Sent: Friday, November 17, 2006 2:54 PM
> > To: Salman Abbas; ccie >> Cisco certification;
> > Duane.Fletcher@morganstanley.com
> > Subject: RE: IP Event Dampening
> >
> > Salman,
> >
> > Default value for the penalty is 1000 which can not be changed. Yes, it
> > increases by 1000 every time it flaps. You are probably looking at the
> > default suppress value which is 2000 also. However you can configure the
> >
> > suppress-threshold value which will decide when to suppress a route. You
> > can read more about it on the following link
> >
> > http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123tcr/1
> >
> > 23tip2r/ip2_c1gt.htm#wp1093971
> >
> > I am sure someone else on the group can add to this.
> >
> > HTH,
> >
> > Hitesh Savjani
> > CCIE # 17151
> >
> >
> > ________________________________
> >
> > From: Salman Abbas [mailto: dukelondon@gmail.com]
> > Sent: Friday, November 17, 2006 1:57 PM
> > To: SAVJANI, HITESH, WWCS; ccie >> Cisco certification;
> > Duane.Fletcher@morganstanley.com
> > Subject: Re: IP Event Dampening
> >
> >
> > Hi Fletcher,
> >
> > I'm not the Sal Abbas who used to work at AT&T.
> >
> > Hi Hitesh,
> >
> > Thanks a bunch for your reply. The default value for "value to start
> > suppressing an interface" is 2000. I've checked that on the router.
> > When you say in 2 flaps, it'll become 2000, do you mean it increases by
> > 1000 every time theres a flap? Is this a documented value somewhere or
> > can I see this on the router? If it starts from 0, why do I always see a
> > value of 2000 in my sh dampening interface output?What do you think the
> > answer should be in the light of this fact?
> >
> > Regards,
> >
> > Salman
> >
> >
> > On 11/18/06, SAVJANI, HITESH, WWCS <hitesh@att.com> wrote:
> >
> >
> > Salman,
> >
> > I think if you want your interface to be suppressed after two
> > flaps then
> > you should set the value to be 2000.
> > Reason for that is it will start from 0 penalty & in 2 flaps will
> > bring
> > it to 2000.
> >
> > HTH,
> >
> > Hitesh Savjani
> > CCIE # 17151
> >
> > -----Original Message-----
> > From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On
> > Behalf Of
> > Salman Abbas
> > Sent: Friday, November 17, 2006 11:36 AM
> > To: ccie >> Cisco certification
> > Subject: IP Event Dampening
> >
> > Hi guys,
> >
> > I want RIP to stop interface e0/0 on my router from participating
> > in routing
> > if it flaps 2 times in a *15* second period. what dampening values
> > will
> > I
> > have to set to achieve this?
> >
> > interface e0/0
> > dampening *15* 1000 __ 60. I think the answer would fit at the
> > third place
> > (value to start supressing an interface) in the dampening command.
> > However,
> > Im not sure. Please help.
> >
> >
> > Thanks a bunch in advance!!!
> >
> > Cheers!
> >
> > Salman
> >
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
-- Ivan
This archive was generated by hypermail 2.1.4 : Fri Dec 01 2006 - 08:05:47 ART