- A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
Re: IP Event Dampening posted 11/19/2006
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]

nice post, mate!
I have expected something like this.


Ivan wrote:
Briefly about M flapps in N seconds can be expressed next formula.

half-life time = N sec
penalty = 1000
suppress value = (M + 1) * penalty / 2 [+/-1]

Let calculate both extremums minimum and maximum.

Minimum) Suppose (M-1) flaps appear during first second, then penalty will (M-1)*penalty. After half-life time penalty will (M - 1) * penalty / 2. Last flap appear on the last second (+ penalty). Totally last compound penalty will (M - 1) * penalty / 2 + penalty = (M + 1) * penalty / 2
Maximum) All flaps appear at the same time. M * penalty.

Difference betweeen this values (M-1)/2*penalty. This difference is always > 0 f M > 1 (ie flap count above one).

[+/- 1]) it is the same as 16:59 and 17:00 discussion can be founded in GS.

Suppressed value must be minimum of these values: min((M+1)*pen/2, M*pen)
if(M == 1) both value equal if(M > 1) (M+1)*pen/2

1) "2 flaps in 15 sec"

half-life time = 15 sec
penalty = 1000
suppress value = (2 + 1) * 1000 / 2 = 1500 [+/- 1]

2) "3 flaps in 30 secs"

half-life time = 30 sec
penalty = 1000
suppress value = (3 + 1) * 1000 / 2 = 2000 [+/- 1]

On Sunday 19 November 2006 14:05, Alexei Monastyrnyi wrote:
just to share quickly my train of thoughts here.

1. "2 flaps in 15 secs" - dampen 15 1000 1500 60
As is was correctly noticed before, half-time starts counting down
immediately and accumulated penalty starts decreases right after flap
happens as well. In this situation we consider events in time frame
after the first flap and during this time frame (watching period) "15
secs" the second flap should gain accumulated penalty that hits the
suppress threshold, whenever it happens. Two extremes here - right after
the first flap and right before "15 secs". With the first extreme
accumulated penalty is near 2000 (two time penalty). With the second
one, it all depends on half-time. If we put "15" as a half-time, by the
end of watching "15 secs" period (which in this case happens to be the
same as half-time) accumulated penalty for the second extreme is as low
as 1500. So we pick 1500 for the suppress threshold. All the rest should
go to defaults (max-time should keep default ration).

2. "3 times in 30 secs" - dampen 30
Will try to cut it short here, assuming you follow my logic from (1).
Again we count down after the first flap and when watching period "30
secs" starts we have accumulated penalty 1000. During this watching
period next two flaps (second and third) should gain accumulated penalty
above suppress threshold. Again, two extremes here - the second flap
happens right after the first one and the third one happens at the very
end of watching period; or both second and third flap happen at the very
end of watching period of 30 secs. To make myself an absolute bore in
your eyes, I would say that it is easy to see that all other situations
are covered by these two extremes. :-). Now it all depends on half-time
(and suppress threshold). Taking half-time 30 secs we have the following.

With the first extreme we gain accumulated penalty nearly (but not more
than) 2000 at the beginning of watching period, counting down,
decreasing stuff and have it nearly (but not less than) 1000 (remaining
penalty) + 1000 (for the third flap) = nearly 2000 by the end of
watching period.

With the second extreme we gain not less than 500 (remaining penalty) by
the end of watching period + 2000 (two flaps) = nearly2500.

Now we choose minimum among 2000 and 2500, it happens to be a default
value 2000.

2001 would not suit well, cause in worst case we gain nearly (but no
more than) 2000. I wold pick 1999 :-) but as Scott said the other day
with regard to time-range ending 16:59 vs 17:00, they shouldn't be that
picky, i.e. one should show the knowledge, rather than ability to
memorize stuff. :-)

IMO the first case shows more knowledge cause one cannot use defaults
there, with there second one it is easy to memorize. So it could be
thought as "easy 3 points" or "hard 3 points" to get on the lab. :-)

Sorry if my post took too much time and energy to get through. :-) It
would be actually interesting to research a more general task "M flaps
in N secs". But not this time. :-)

Have a good one,

Scott Morris wrote:
IMHO, I'd pick a suppress value of 1 more than 2x the penalty in this
case. Instead of 3000, use 2001.  Even sliding down, statistically with 3
flaps in 30 seconds, no matter where on the scale of half-life you are,
that will always work.


Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE #153, CISSP, et al. CCSI/JNCI-M/JNCI-J IPExpert VP - Curriculum Development IPExpert Sr. Technical Instructor smorris@xxxxxxxxxxxx

-----Original Message-----
From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx] On Behalf Of
Sent: Saturday, November 18, 2006 2:02 AM
To: dukelondon@xxxxxxxxx
Cc: hitesh@xxxxxxx; ccielab@xxxxxxxxxxxxxx
Subject: RE: IP Event Dampening

I labbed this one up as this post suggests and learned that he was indeed
correct about how the penalty moves....I am so sorry that I do not have
time right now to research the definitive answer <again> - but I think
you should have all the info you need now to ensure that you will get the
dampening behavior required given certain values.

I suggest you lab this up.  With "dampen 30 1000 3000 60" the interface
will not dampen in 30 seconds with 3 flaps..

True, the half life is when the value is decayed by half its original
penalty.  But since its an exponentially decaying algorithm, the penalty
begins decaying IMMEDIATELY.

What this means is, if you flap the interface with dampening (dampen 30
1000 3000 60) you will see the penalty at 1000 immediately, but then
querying the dampening for the interface again will indicate another
value like 893.  And again, 773, etc. until at 30 seconds the value will
be 500 for the first flap.

If you flap it a second time then the penalty will be the original
decayed penalty value at that moment PLUS the new penalty value (e.g.
1000).  And the exponential decay begins again.  Query the interface and
you will see the penalty between 500 and 1500 and decaying fast.  The
same holds true for a third flap.

In short, a suppress value of 3000, as configured, will not dampen the
interface with 3 flaps in 30 seconds because the cumulative penalty will
be < 3000 at the half-life; guaranteed!


From: Salman Abbas [mailto:dukelondon@xxxxxxxxx]
Sent: Saturday, November 18, 2006 1:40 AM
To: Sequeira, Anthony (NETg)
Cc: hitesh@xxxxxxx; ccielab@xxxxxxxxxxxxxx
Subject: Re: IP Event Dampening

Hi Hitesh,

Thanks a bunch bro.

Hi Anthony,

Thanks for the thread but what should the answer be, taking Hitesh's
reply and the thread into consideration?

I mean dampening 15 1000 ___ 60 .

Pls advise,

Thanks and Regards,


On 11/18/06, anthony.sequeira@xxxxxxxxxxx <anthony.sequeira@xxxxxxxxxxx

Careful - this feature does not work like you think - here is an
excellent thread from the archives on the subject. . . note that the
biggest surprise is how the feature uses an exponentially decaying
algorithm - jeez.....

Anthony J. Sequeira

-----Original Message----- From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx ] On Behalf Of SAVJANI, HITESH, WWCS Sent: Friday, November 17, 2006 2:54 PM To: Salman Abbas; ccie >> Cisco certification; Duane.Fletcher@xxxxxxxxxxxxxxxxx Subject: RE: IP Event Dampening


Default value for the penalty is 1000 which can not be changed. Yes, it
increases by 1000 every time it flaps. You are probably looking at the
default suppress value which is 2000 also. However you can configure the

suppress-threshold value which will decide when to suppress a route. You
can read more about it on the following link


I am sure someone else on the group can add to this.


Hitesh Savjani
CCIE # 17151


From: Salman Abbas [mailto: dukelondon@xxxxxxxxx]
Sent: Friday, November 17, 2006 1:57 PM
To: SAVJANI, HITESH, WWCS; ccie >> Cisco certification;
Subject: Re: IP Event Dampening

Hi Fletcher,

I'm not the Sal Abbas who used to work at AT&T.

Hi Hitesh,

Thanks a bunch for your reply. The default value for "value to start
suppressing an interface" is 2000. I've checked that on the router.
When you say in 2 flaps, it'll become 2000, do you mean it increases by
1000 every time theres a flap? Is this a documented value somewhere or
can I see this on the router? If it starts from 0, why do I always see a
value of 2000 in my sh dampening interface output?What do you think the
answer should be in the light of this fact?



On 11/18/06, SAVJANI, HITESH, WWCS <hitesh@xxxxxxx> wrote:


       I think if you want your interface to be suppressed after two
flaps then
       you should set the value to be 2000.
       Reason for that is it will start from 0 penalty & in 2 flaps will
       it to 2000.


       Hitesh Savjani
       CCIE # 17151

       -----Original Message-----
       From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx] On
Behalf Of
       Salman Abbas
       Sent: Friday, November 17, 2006 11:36 AM
       To: ccie >> Cisco certification
       Subject: IP Event Dampening

Hi guys,

       I want RIP to stop interface e0/0 on my router from participating
in routing
       if it flaps 2 times in a *15* second period. what dampening values
       have to set to achieve this?

       interface e0/0
       dampening *15* 1000 __ 60. I think the answer would fit at the
third place
       (value to start supressing an interface) in the dampening command.
       Im not sure. Please help.

Thanks a bunch in advance!!!



_______________________________________________________________________ Subscription information may be found at:

Subscription information may be found at:

Subscription information may be found at:

Subscription information may be found at:
Subscription information may be found at: