From: Salman Abbas (dukelondon@gmail.com)
Date: Mon Nov 20 2006 - 05:15:42 ART
Hi guys,
As the initiator of this discussion, I would like to thank all of you for
helping so much and making this concept crystal clear.
Thanks again,
Cheers!!!
Salman
On 11/20/06, Elias Chari <elias.chari@gmail.com> wrote:
>
> A rather less scientific method, which seems to work for me, would be.
>
> Let's say you want the interface to be removed from the RT if it flaps 3
> times withing 30sec.
>
> The worst case scenario which would determine if your suppress value will
> work is to have 2 Flaps in the first second and 1 Flap just before
> half-life
> (taken as 30 sec). So assume this approach.
>
> In the first second you will have 2000 penalty points (2flaps).
>
> At the end of the half-life period you will have 1000 points. And let's
> say
> just before half life you will have 1001.
>
> Now assume the 3rd flap occurs just before half-life, you will have
> 1000+1001 penalty points.
>
> Therefore your suppress value is 2001 and half-life 30sec.
>
> Similarly if you want to suppress after 2 flaps in 15 sec you would have
> half-life 15sec and suppress value = 1501
>
> I believe Scott provided the same answer and Ivan's formula comes to the
> same conclusion, but I find it easier working it out this way.
>
> HTH
> Elias
>
> On 11/19/06, Alexei Monastyrnyi <alexeim@orcsoftware.com> wrote:
> >
> > nice post, mate!
> > I have expected something like this.
> >
> > cheers,
> > A.
> >
> > Ivan wrote:
> > > Briefly about M flapps in N seconds can be expressed next formula.
> > >
> > > half-life time = N sec
> > > penalty = 1000
> > > suppress value = (M + 1) * penalty / 2 [+/-1]
> > >
> > > Let calculate both extremums minimum and maximum.
> > >
> > > Minimum) Suppose (M-1) flaps appear during first second, then penalty
> > will
> > > (M-1)*penalty. After half-life time penalty will (M - 1) * penalty /
> 2.
> > > Last flap appear on the last second (+ penalty). Totally last compound
> > penalty
> > > will (M - 1) * penalty / 2 + penalty = (M + 1) * penalty / 2
> > > Maximum) All flaps appear at the same time. M * penalty.
> > >
> > > Difference betweeen this values (M-1)/2*penalty. This difference is
> > always > 0
> > > f M > 1 (ie flap count above one).
> > >
> > > [+/- 1]) it is the same as 16:59 and 17:00 discussion can be founded
> in
> > GS.
> > >
> > > Suppressed value must be minimum of these values: min((M+1)*pen/2,
> > M*pen)
> > > if(M == 1) both value equal
> > > if(M > 1) (M+1)*pen/2
> > >
> > > Verify:
> > > 1) "2 flaps in 15 sec"
> > >
> > > half-life time = 15 sec
> > > penalty = 1000
> > > suppress value = (2 + 1) * 1000 / 2 = 1500 [+/- 1]
> > >
> > > 2) "3 flaps in 30 secs"
> > >
> > > half-life time = 30 sec
> > > penalty = 1000
> > > suppress value = (3 + 1) * 1000 / 2 = 2000 [+/- 1]
> > >
> > >
> > > On Sunday 19 November 2006 14:05, Alexei Monastyrnyi wrote:
> > >
> > >> Folks,
> > >> just to share quickly my train of thoughts here.
> > >>
> > >> 1. "2 flaps in 15 secs" - dampen 15 1000 1500 60
> > >> As is was correctly noticed before, half-time starts counting down
> > >> immediately and accumulated penalty starts decreases right after flap
> > >> happens as well. In this situation we consider events in time frame
> > >> after the first flap and during this time frame (watching period) "15
> > >> secs" the second flap should gain accumulated penalty that hits the
> > >> suppress threshold, whenever it happens. Two extremes here - right
> > after
> > >> the first flap and right before "15 secs". With the first extreme
> > >> accumulated penalty is near 2000 (two time penalty). With the second
> > >> one, it all depends on half-time. If we put "15" as a half-time, by
> the
> > >> end of watching "15 secs" period (which in this case happens to be
> the
> > >> same as half-time) accumulated penalty for the second extreme is as
> low
> > >> as 1500. So we pick 1500 for the suppress threshold. All the rest
> > should
> > >> go to defaults (max-time should keep default ration).
> > >>
> > >> 2. "3 times in 30 secs" - dampen 30
> > >> Will try to cut it short here, assuming you follow my logic from (1).
> > >> Again we count down after the first flap and when watching period "30
> > >> secs" starts we have accumulated penalty 1000. During this watching
> > >> period next two flaps (second and third) should gain accumulated
> > penalty
> > >> above suppress threshold. Again, two extremes here - the second flap
> > >> happens right after the first one and the third one happens at the
> very
> > >> end of watching period; or both second and third flap happen at the
> > very
> > >> end of watching period of 30 secs. To make myself an absolute bore in
> > >> your eyes, I would say that it is easy to see that all other
> situations
> > >> are covered by these two extremes. :-). Now it all depends on
> half-time
> > >> (and suppress threshold). Taking half-time 30 secs we have the
> > following.
> > >>
> > >> With the first extreme we gain accumulated penalty nearly (but not
> more
> > >> than) 2000 at the beginning of watching period, counting down,
> > >> decreasing stuff and have it nearly (but not less than) 1000
> (remaining
> >
> > >> penalty) + 1000 (for the third flap) = nearly 2000 by the end of
> > >> watching period.
> > >>
> > >> With the second extreme we gain not less than 500 (remaining penalty)
> > by
> > >> the end of watching period + 2000 (two flaps) = nearly2500.
> > >>
> > >> Now we choose minimum among 2000 and 2500, it happens to be a default
> > >> value 2000.
> > >>
> > >> 2001 would not suit well, cause in worst case we gain nearly (but no
> > >> more than) 2000. I wold pick 1999 :-) but as Scott said the other day
> > >> with regard to time-range ending 16:59 vs 17:00, they shouldn't be
> that
> > >> picky, i.e. one should show the knowledge, rather than ability to
> > >> memorize stuff. :-)
> > >>
> > >> IMO the first case shows more knowledge cause one cannot use defaults
> > >> there, with there second one it is easy to memorize. So it could be
> > >> thought as "easy 3 points" or "hard 3 points" to get on the lab. :-)
> > >>
> > >> Sorry if my post took too much time and energy to get through. :-) It
> > >> would be actually interesting to research a more general task "M
> flaps
> > >> in N secs". But not this time. :-)
> > >>
> > >> Have a good one,
> > >> A.
> > >>
> > >> Scott Morris wrote:
> > >>
> > >>> IMHO, I'd pick a suppress value of 1 more than 2x the penalty in
> this
> > >>> case. Instead of 3000, use 2001. Even sliding down, statistically
> > with 3
> > >>> flaps in 30 seconds, no matter where on the scale of half-life you
> > are,
> > >>> that will always work.
> > >>>
> > >>> HTH,
> > >>>
> > >>>
> > >>> Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713,
> > JNCIE
> > >>> #153, CISSP, et al.
> > >>> CCSI/JNCI-M/JNCI-J
> > >>> IPExpert VP - Curriculum Development
> > >>> IPExpert Sr. Technical Instructor
> > >>> smorris@ipexpert.com
> > >>> http://www.ipexpert.com
> > >>>
> > >>>
> > >>>
> > >>> -----Original Message-----
> > >>> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf
> > Of
> > >>> anthony.sequeira@thomson.com
> > >>> Sent: Saturday, November 18, 2006 2:02 AM
> > >>> To: dukelondon@gmail.com
> > >>> Cc: hitesh@att.com; ccielab@groupstudy.com
> > >>> Subject: RE: IP Event Dampening
> > >>>
> > >>> I labbed this one up as this post suggests and learned that he was
> > indeed
> > >>> correct about how the penalty moves....I am so sorry that I do not
> > have
> > >>> time right now to research the definitive answer <again> - but I
> think
> > >>> you should have all the info you need now to ensure that you will
> get
> > the
> > >>> dampening behavior required given certain values.
> > >>>
> > >>>
> > >>>
> > >>> I suggest you lab this up. With "dampen 30 1000 3000 60" the
> > interface
> > >>> will not dampen in 30 seconds with 3 flaps..
> > >>>
> > >>> True, the half life is when the value is decayed by half its
> original
> > >>> penalty. But since its an exponentially decaying algorithm, the
> > penalty
> > >>> begins decaying IMMEDIATELY.
> > >>>
> > >>> What this means is, if you flap the interface with dampening (dampen
> > 30
> > >>> 1000 3000 60) you will see the penalty at 1000 immediately, but then
> > >>> querying the dampening for the interface again will indicate another
> > >>> value like 893. And again, 773, etc. until at 30 seconds the value
> > will
> > >>> be 500 for the first flap.
> > >>>
> > >>> If you flap it a second time then the penalty will be the original
> > >>> decayed penalty value at that moment PLUS the new penalty value (e.g
> .
> > >>> 1000). And the exponential decay begins again. Query the interface
> > and
> > >>> you will see the penalty between 500 and 1500 and decaying
> fast. The
> > >>> same holds true for a third flap.
> > >>>
> > >>> In short, a suppress value of 3000, as configured, will not dampen
> the
> > >>> interface with 3 flaps in 30 seconds because the cumulative penalty
> > will
> > >>> be < 3000 at the half-life; guaranteed!
> > >>>
> > >>>
> > >>>
> > >>>
> > >>> ________________________________
> > >>>
> > >>> From: Salman Abbas [mailto: dukelondon@gmail.com]
> > >>> Sent: Saturday, November 18, 2006 1:40 AM
> > >>> To: Sequeira, Anthony (NETg)
> > >>> Cc: hitesh@att.com ; ccielab@groupstudy.com
> > >>> Subject: Re: IP Event Dampening
> > >>>
> > >>>
> > >>>
> > >>> Hi Hitesh,
> > >>>
> > >>>
> > >>>
> > >>> Thanks a bunch bro.
> > >>>
> > >>>
> > >>> Hi Anthony,
> > >>>
> > >>>
> > >>>
> > >>> Thanks for the thread but what should the answer be, taking Hitesh's
> > >>> reply and the thread into consideration?
> > >>>
> > >>> I mean dampening 15 1000 ___ 60 .
> > >>>
> > >>>
> > >>>
> > >>> Pls advise,
> > >>>
> > >>>
> > >>>
> > >>> Thanks and Regards,
> > >>>
> > >>>
> > >>> Salman
> > >>>
> > >>>
> > >>>
> > >>> On 11/18/06, anthony.sequeira@thomson.com <
> > anthony.sequeira@thomson.com
> > >>>
> > >>>
> > >>>> wrote:
> > >>>>
> > >>> Careful - this feature does not work like you think - here is an
> > >>> excellent thread from the archives on the subject. . . note that the
> > >>> biggest surprise is how the feature uses an exponentially decaying
> > >>> algorithm - jeez.....
> > >>>
> > >>> http://adserver.groupstudy.com/archives/ccielab/200605/msg01011.html
> > >>>
> > >>> Anthony J. Sequeira
> > >>> #15626
> > >>>
> > >>>
> > >>> -----Original Message-----
> > >>> From: nobody@groupstudy.com [mailto: nobody@groupstudy.com ] On
> Behalf
> > Of
> > >>> SAVJANI, HITESH, WWCS
> > >>> Sent: Friday, November 17, 2006 2:54 PM
> > >>> To: Salman Abbas; ccie >> Cisco certification;
> > >>> Duane.Fletcher@morganstanley.com
> > >>> Subject: RE: IP Event Dampening
> > >>>
> > >>> Salman,
> > >>>
> > >>> Default value for the penalty is 1000 which can not be changed. Yes,
> > it
> > >>> increases by 1000 every time it flaps. You are probably looking at
> the
> > >>> default suppress value which is 2000 also. However you can configure
> > the
> > >>>
> > >>> suppress-threshold value which will decide when to suppress a route.
> > You
> > >>> can read more about it on the following link
> > >>>
> > >>>
> http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123tcr/1
> >
> > >>>
> > >>> 23tip2r/ip2_c1gt.htm#wp1093971
> > >>>
> > >>> I am sure someone else on the group can add to this.
> > >>>
> > >>> HTH,
> > >>>
> > >>> Hitesh Savjani
> > >>> CCIE # 17151
> > >>>
> > >>>
> > >>> ________________________________
> > >>>
> > >>> From: Salman Abbas [mailto: dukelondon@gmail.com ]
> > >>> Sent: Friday, November 17, 2006 1:57 PM
> > >>> To: SAVJANI, HITESH, WWCS; ccie >> Cisco certification;
> > >>> Duane.Fletcher@morganstanley.com
> > >>> Subject: Re: IP Event Dampening
> > >>>
> > >>>
> > >>> Hi Fletcher,
> > >>>
> > >>> I'm not the Sal Abbas who used to work at AT&T.
> > >>>
> > >>> Hi Hitesh,
> > >>>
> > >>> Thanks a bunch for your reply. The default value for "value to start
> > >>> suppressing an interface" is 2000. I've checked that on the router.
> > >>> When you say in 2 flaps, it'll become 2000, do you mean it increases
> > by
> > >>> 1000 every time theres a flap? Is this a documented value somewhere
> or
> > >>> can I see this on the router? If it starts from 0, why do I always
> see
> > a
> > >>> value of 2000 in my sh dampening interface output?What do you think
> > the
> > >>> answer should be in the light of this fact?
> > >>>
> > >>> Regards,
> > >>>
> > >>> Salman
> > >>>
> > >>>
> > >>> On 11/18/06, SAVJANI, HITESH, WWCS < hitesh@att.com> wrote:
> > >>>
> > >>>
> > >>> Salman,
> > >>>
> > >>> I think if you want your interface to be suppressed after two
> > >>> flaps then
> > >>> you should set the value to be 2000.
> > >>> Reason for that is it will start from 0 penalty & in 2 flaps
> > will
> > >>> bring
> > >>> it to 2000.
> > >>>
> > >>> HTH,
> > >>>
> > >>> Hitesh Savjani
> > >>> CCIE # 17151
> > >>>
> > >>> -----Original Message-----
> > >>> From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On
> > >>> Behalf Of
> > >>> Salman Abbas
> > >>> Sent: Friday, November 17, 2006 11:36 AM
> > >>> To: ccie >> Cisco certification
> > >>> Subject: IP Event Dampening
> > >>>
> > >>> Hi guys,
> > >>>
> > >>> I want RIP to stop interface e0/0 on my router from
> > participating
> > >>> in routing
> > >>> if it flaps 2 times in a *15* second period. what dampening
> > values
> > >>> will
> > >>> I
> > >>> have to set to achieve this?
> > >>>
> > >>> interface e0/0
> > >>> dampening *15* 1000 __ 60. I think the answer would fit at
> the
> > >>> third place
> > >>> (value to start supressing an interface) in the dampening
> > command.
> > >>> However,
> > >>> Im not sure. Please help.
> > >>>
> > >>>
> > >>> Thanks a bunch in advance!!!
> > >>>
> > >>> Cheers!
> > >>>
> > >>> Salman
> > >>>
> > >>>
> > >>>
> > _______________________________________________________________________
> > >>> Subscription information may be found at:
> > >>> http://www.groupstudy.com/list/CCIELab.html
> > >>>
> > >>>
> > _______________________________________________________________________
> > >>> Subscription information may be found at:
> > >>> http://www.groupstudy.com/list/CCIELab.html
> > >>>
> > >>>
> > _______________________________________________________________________
> > >>> Subscription information may be found at:
> > >>> http://www.groupstudy.com/list/CCIELab.html
> > >>>
> > >>>
> > _______________________________________________________________________
> > >>> Subscription information may be found at:
> > >>> http://www.groupstudy.com/list/CCIELab.html
> > >>>
> > >>
> _______________________________________________________________________
> >
> > >> Subscription information may be found at:
> > >> http://www.groupstudy.com/list/CCIELab.html
> >
> > _______________________________________________________________________
> > Subscription information may be found at:
> > http://www.groupstudy.com/list/CCIELab.html
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
This archive was generated by hypermail 2.1.4 : Fri Dec 01 2006 - 08:05:47 ART