From: Alexei Monastyrnyi (alexeim@orcsoftware.com)
Date: Sun Nov 19 2006 - 16:01:14 ART
nice post, mate!
I have expected something like this.
cheers,
A.
Ivan wrote:
> Briefly about M flapps in N seconds can be expressed next formula.
>
> half-life time = N sec
> penalty = 1000
> suppress value = (M + 1) * penalty / 2 [+/-1]
>
> Let calculate both extremums minimum and maximum.
>
> Minimum) Suppose (M-1) flaps appear during first second, then penalty will
> (M-1)*penalty. After half-life time penalty will (M - 1) * penalty / 2.
> Last flap appear on the last second (+ penalty). Totally last compound penalty
> will (M - 1) * penalty / 2 + penalty = (M + 1) * penalty / 2
> Maximum) All flaps appear at the same time. M * penalty.
>
> Difference betweeen this values (M-1)/2*penalty. This difference is always > 0
> f M > 1 (ie flap count above one).
>
> [+/- 1]) it is the same as 16:59 and 17:00 discussion can be founded in GS.
>
> Suppressed value must be minimum of these values: min((M+1)*pen/2, M*pen)
> if(M == 1) both value equal
> if(M > 1) (M+1)*pen/2
>
> Verify:
> 1) "2 flaps in 15 sec"
>
> half-life time = 15 sec
> penalty = 1000
> suppress value = (2 + 1) * 1000 / 2 = 1500 [+/- 1]
>
> 2) "3 flaps in 30 secs"
>
> half-life time = 30 sec
> penalty = 1000
> suppress value = (3 + 1) * 1000 / 2 = 2000 [+/- 1]
>
>
> On Sunday 19 November 2006 14:05, Alexei Monastyrnyi wrote:
>
>> Folks,
>> just to share quickly my train of thoughts here.
>>
>> 1. "2 flaps in 15 secs" - dampen 15 1000 1500 60
>> As is was correctly noticed before, half-time starts counting down
>> immediately and accumulated penalty starts decreases right after flap
>> happens as well. In this situation we consider events in time frame
>> after the first flap and during this time frame (watching period) "15
>> secs" the second flap should gain accumulated penalty that hits the
>> suppress threshold, whenever it happens. Two extremes here - right after
>> the first flap and right before "15 secs". With the first extreme
>> accumulated penalty is near 2000 (two time penalty). With the second
>> one, it all depends on half-time. If we put "15" as a half-time, by the
>> end of watching "15 secs" period (which in this case happens to be the
>> same as half-time) accumulated penalty for the second extreme is as low
>> as 1500. So we pick 1500 for the suppress threshold. All the rest should
>> go to defaults (max-time should keep default ration).
>>
>> 2. "3 times in 30 secs" - dampen 30
>> Will try to cut it short here, assuming you follow my logic from (1).
>> Again we count down after the first flap and when watching period "30
>> secs" starts we have accumulated penalty 1000. During this watching
>> period next two flaps (second and third) should gain accumulated penalty
>> above suppress threshold. Again, two extremes here - the second flap
>> happens right after the first one and the third one happens at the very
>> end of watching period; or both second and third flap happen at the very
>> end of watching period of 30 secs. To make myself an absolute bore in
>> your eyes, I would say that it is easy to see that all other situations
>> are covered by these two extremes. :-). Now it all depends on half-time
>> (and suppress threshold). Taking half-time 30 secs we have the following.
>>
>> With the first extreme we gain accumulated penalty nearly (but not more
>> than) 2000 at the beginning of watching period, counting down,
>> decreasing stuff and have it nearly (but not less than) 1000 (remaining
>> penalty) + 1000 (for the third flap) = nearly 2000 by the end of
>> watching period.
>>
>> With the second extreme we gain not less than 500 (remaining penalty) by
>> the end of watching period + 2000 (two flaps) = nearly2500.
>>
>> Now we choose minimum among 2000 and 2500, it happens to be a default
>> value 2000.
>>
>> 2001 would not suit well, cause in worst case we gain nearly (but no
>> more than) 2000. I wold pick 1999 :-) but as Scott said the other day
>> with regard to time-range ending 16:59 vs 17:00, they shouldn't be that
>> picky, i.e. one should show the knowledge, rather than ability to
>> memorize stuff. :-)
>>
>> IMO the first case shows more knowledge cause one cannot use defaults
>> there, with there second one it is easy to memorize. So it could be
>> thought as "easy 3 points" or "hard 3 points" to get on the lab. :-)
>>
>> Sorry if my post took too much time and energy to get through. :-) It
>> would be actually interesting to research a more general task "M flaps
>> in N secs". But not this time. :-)
>>
>> Have a good one,
>> A.
>>
>> Scott Morris wrote:
>>
>>> IMHO, I'd pick a suppress value of 1 more than 2x the penalty in this
>>> case. Instead of 3000, use 2001. Even sliding down, statistically with 3
>>> flaps in 30 seconds, no matter where on the scale of half-life you are,
>>> that will always work.
>>>
>>> HTH,
>>>
>>>
>>> Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE
>>> #153, CISSP, et al.
>>> CCSI/JNCI-M/JNCI-J
>>> IPExpert VP - Curriculum Development
>>> IPExpert Sr. Technical Instructor
>>> smorris@ipexpert.com
>>> http://www.ipexpert.com
>>>
>>>
>>>
>>> -----Original Message-----
>>> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
>>> anthony.sequeira@thomson.com
>>> Sent: Saturday, November 18, 2006 2:02 AM
>>> To: dukelondon@gmail.com
>>> Cc: hitesh@att.com; ccielab@groupstudy.com
>>> Subject: RE: IP Event Dampening
>>>
>>> I labbed this one up as this post suggests and learned that he was indeed
>>> correct about how the penalty moves....I am so sorry that I do not have
>>> time right now to research the definitive answer <again> - but I think
>>> you should have all the info you need now to ensure that you will get the
>>> dampening behavior required given certain values.
>>>
>>>
>>>
>>> I suggest you lab this up. With "dampen 30 1000 3000 60" the interface
>>> will not dampen in 30 seconds with 3 flaps..
>>>
>>> True, the half life is when the value is decayed by half its original
>>> penalty. But since its an exponentially decaying algorithm, the penalty
>>> begins decaying IMMEDIATELY.
>>>
>>> What this means is, if you flap the interface with dampening (dampen 30
>>> 1000 3000 60) you will see the penalty at 1000 immediately, but then
>>> querying the dampening for the interface again will indicate another
>>> value like 893. And again, 773, etc. until at 30 seconds the value will
>>> be 500 for the first flap.
>>>
>>> If you flap it a second time then the penalty will be the original
>>> decayed penalty value at that moment PLUS the new penalty value (e.g.
>>> 1000). And the exponential decay begins again. Query the interface and
>>> you will see the penalty between 500 and 1500 and decaying fast. The
>>> same holds true for a third flap.
>>>
>>> In short, a suppress value of 3000, as configured, will not dampen the
>>> interface with 3 flaps in 30 seconds because the cumulative penalty will
>>> be < 3000 at the half-life; guaranteed!
>>>
>>>
>>>
>>>
>>> ________________________________
>>>
>>> From: Salman Abbas [mailto:dukelondon@gmail.com]
>>> Sent: Saturday, November 18, 2006 1:40 AM
>>> To: Sequeira, Anthony (NETg)
>>> Cc: hitesh@att.com; ccielab@groupstudy.com
>>> Subject: Re: IP Event Dampening
>>>
>>>
>>>
>>> Hi Hitesh,
>>>
>>>
>>>
>>> Thanks a bunch bro.
>>>
>>>
>>> Hi Anthony,
>>>
>>>
>>>
>>> Thanks for the thread but what should the answer be, taking Hitesh's
>>> reply and the thread into consideration?
>>>
>>> I mean dampening 15 1000 ___ 60 .
>>>
>>>
>>>
>>> Pls advise,
>>>
>>>
>>>
>>> Thanks and Regards,
>>>
>>>
>>> Salman
>>>
>>>
>>>
>>> On 11/18/06, anthony.sequeira@thomson.com <anthony.sequeira@thomson.com
>>>
>>>
>>>> wrote:
>>>>
>>> Careful - this feature does not work like you think - here is an
>>> excellent thread from the archives on the subject. . . note that the
>>> biggest surprise is how the feature uses an exponentially decaying
>>> algorithm - jeez.....
>>>
>>> http://adserver.groupstudy.com/archives/ccielab/200605/msg01011.html
>>>
>>> Anthony J. Sequeira
>>> #15626
>>>
>>>
>>> -----Original Message-----
>>> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com ] On Behalf Of
>>> SAVJANI, HITESH, WWCS
>>> Sent: Friday, November 17, 2006 2:54 PM
>>> To: Salman Abbas; ccie >> Cisco certification;
>>> Duane.Fletcher@morganstanley.com
>>> Subject: RE: IP Event Dampening
>>>
>>> Salman,
>>>
>>> Default value for the penalty is 1000 which can not be changed. Yes, it
>>> increases by 1000 every time it flaps. You are probably looking at the
>>> default suppress value which is 2000 also. However you can configure the
>>>
>>> suppress-threshold value which will decide when to suppress a route. You
>>> can read more about it on the following link
>>>
>>> http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123tcr/1
>>>
>>> 23tip2r/ip2_c1gt.htm#wp1093971
>>>
>>> I am sure someone else on the group can add to this.
>>>
>>> HTH,
>>>
>>> Hitesh Savjani
>>> CCIE # 17151
>>>
>>>
>>> ________________________________
>>>
>>> From: Salman Abbas [mailto: dukelondon@gmail.com]
>>> Sent: Friday, November 17, 2006 1:57 PM
>>> To: SAVJANI, HITESH, WWCS; ccie >> Cisco certification;
>>> Duane.Fletcher@morganstanley.com
>>> Subject: Re: IP Event Dampening
>>>
>>>
>>> Hi Fletcher,
>>>
>>> I'm not the Sal Abbas who used to work at AT&T.
>>>
>>> Hi Hitesh,
>>>
>>> Thanks a bunch for your reply. The default value for "value to start
>>> suppressing an interface" is 2000. I've checked that on the router.
>>> When you say in 2 flaps, it'll become 2000, do you mean it increases by
>>> 1000 every time theres a flap? Is this a documented value somewhere or
>>> can I see this on the router? If it starts from 0, why do I always see a
>>> value of 2000 in my sh dampening interface output?What do you think the
>>> answer should be in the light of this fact?
>>>
>>> Regards,
>>>
>>> Salman
>>>
>>>
>>> On 11/18/06, SAVJANI, HITESH, WWCS <hitesh@att.com> wrote:
>>>
>>>
>>> Salman,
>>>
>>> I think if you want your interface to be suppressed after two
>>> flaps then
>>> you should set the value to be 2000.
>>> Reason for that is it will start from 0 penalty & in 2 flaps will
>>> bring
>>> it to 2000.
>>>
>>> HTH,
>>>
>>> Hitesh Savjani
>>> CCIE # 17151
>>>
>>> -----Original Message-----
>>> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On
>>> Behalf Of
>>> Salman Abbas
>>> Sent: Friday, November 17, 2006 11:36 AM
>>> To: ccie >> Cisco certification
>>> Subject: IP Event Dampening
>>>
>>> Hi guys,
>>>
>>> I want RIP to stop interface e0/0 on my router from participating
>>> in routing
>>> if it flaps 2 times in a *15* second period. what dampening values
>>> will
>>> I
>>> have to set to achieve this?
>>>
>>> interface e0/0
>>> dampening *15* 1000 __ 60. I think the answer would fit at the
>>> third place
>>> (value to start supressing an interface) in the dampening command.
>>> However,
>>> Im not sure. Please help.
>>>
>>>
>>> Thanks a bunch in advance!!!
>>>
>>> Cheers!
>>>
>>> Salman
>>>
>>>
>>> _______________________________________________________________________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/list/CCIELab.html
>>>
>>> _______________________________________________________________________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/list/CCIELab.html
>>>
>>> _______________________________________________________________________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/list/CCIELab.html
>>>
>>> _______________________________________________________________________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/list/CCIELab.html
>>>
>> _______________________________________________________________________
>> Subscription information may be found at:
>> http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Fri Dec 01 2006 - 08:05:47 ART