GroupStudy.com GroupStudy.com - A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
Re: IP Event Dampening posted 11/19/2006
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]


A rather less scientific method, which seems to work for me, would be.

Let's say you want the interface to be removed from the RT if it flaps 3
times withing 30sec.

The worst case scenario which would determine if your suppress value will
work is to have 2 Flaps in the first second and 1 Flap just before half-life
(taken as 30 sec). So assume this approach.

In the first second you will have 2000 penalty points (2flaps).

At the end of the half-life period you will have 1000 points. And let's say
just before half life you will have 1001.

Now assume the 3rd flap occurs just before half-life, you will have
1000+1001 penalty points.

Therefore your suppress value is 2001 and half-life 30sec.

Similarly if you want to suppress after 2 flaps in 15 sec you would have
half-life 15sec and suppress value = 1501

I believe Scott provided the same answer and Ivan's formula comes to the
same conclusion, but I find it easier working it out this way.

HTH
Elias

On 11/19/06, Alexei Monastyrnyi <alexeim@xxxxxxxxxxxxxxx> wrote:
>
> nice post, mate!
> I have expected something like this.
>
> cheers,
> A.
>
> Ivan wrote:
> > Briefly about M flapps in N seconds can be expressed next formula.
> >
> > half-life time = N sec
> > penalty = 1000
> > suppress value = (M + 1) * penalty / 2 [+/-1]
> >
> > Let calculate both extremums minimum and maximum.
> >
> > Minimum) Suppose (M-1) flaps appear during first second, then penalty
> will
> > (M-1)*penalty. After half-life time penalty will (M - 1) * penalty / 2.
> > Last flap appear on the last second (+ penalty). Totally last compound
> penalty
> > will (M - 1) * penalty / 2 + penalty = (M + 1) * penalty / 2
> > Maximum) All flaps appear at the same time. M * penalty.
> >
> > Difference betweeen this values (M-1)/2*penalty. This difference is
> always > 0
> > f M > 1 (ie flap count above one).
> >
> > [+/- 1]) it is the same as 16:59 and 17:00 discussion can be founded in
> GS.
> >
> > Suppressed value must be minimum of these values: min((M+1)*pen/2,
> M*pen)
> > if(M == 1) both value equal
> > if(M > 1) (M+1)*pen/2
> >
> > Verify:
> > 1) "2 flaps in 15 sec"
> >
> > half-life time = 15 sec
> > penalty = 1000
> > suppress value = (2 + 1) * 1000 / 2 = 1500 [+/- 1]
> >
> > 2) "3 flaps in 30 secs"
> >
> > half-life time = 30 sec
> > penalty = 1000
> > suppress value = (3 + 1) * 1000 / 2 = 2000 [+/- 1]
> >
> >
> > On Sunday 19 November 2006 14:05, Alexei Monastyrnyi wrote:
> >
> >> Folks,
> >> just to share quickly my train of thoughts here.
> >>
> >> 1. "2 flaps in 15 secs" - dampen 15 1000 1500 60
> >> As is was correctly noticed before, half-time starts counting down
> >> immediately and accumulated penalty starts decreases right after flap
> >> happens as well. In this situation we consider events in time frame
> >> after the first flap and during this time frame (watching period) "15
> >> secs" the second flap should gain accumulated penalty that hits the
> >> suppress threshold, whenever it happens. Two extremes here - right
> after
> >> the first flap and right before "15 secs". With the first extreme
> >> accumulated penalty is near 2000 (two time penalty). With the second
> >> one, it all depends on half-time. If we put "15" as a half-time, by the
> >> end of watching "15 secs" period (which in this case happens to be the
> >> same as half-time) accumulated penalty for the second extreme is as low
> >> as 1500. So we pick 1500 for the suppress threshold. All the rest
> should
> >> go to defaults (max-time should keep default ration).
> >>
> >> 2. "3 times in 30 secs" - dampen 30
> >> Will try to cut it short here, assuming you follow my logic from (1).
> >> Again we count down after the first flap and when watching period "30
> >> secs" starts we have accumulated penalty 1000. During this watching
> >> period next two flaps (second and third) should gain accumulated
> penalty
> >> above suppress threshold. Again, two extremes here - the second flap
> >> happens right after the first one and the third one happens at the very
> >> end of watching period; or both second and third flap happen at the
> very
> >> end of watching period of 30 secs. To make myself an absolute bore in
> >> your eyes, I would say that it is easy to see that all other situations
> >> are covered by these two extremes. :-). Now it all depends on half-time
> >> (and suppress threshold). Taking half-time 30 secs we have the
> following.
> >>
> >> With the first extreme we gain accumulated penalty nearly (but not more
> >> than) 2000 at the beginning of watching period, counting down,
> >> decreasing stuff and have it nearly (but not less than) 1000 (remaining
>
> >> penalty) + 1000 (for the third flap) = nearly 2000 by the end of
> >> watching period.
> >>
> >> With the second extreme we gain not less than 500 (remaining penalty)
> by
> >> the end of watching period + 2000 (two flaps) = nearly2500.
> >>
> >> Now we choose minimum among 2000 and 2500, it happens to be a default
> >> value 2000.
> >>
> >> 2001 would not suit well, cause in worst case we gain nearly (but no
> >> more than) 2000. I wold pick 1999 :-) but as Scott said the other day
> >> with regard to time-range ending 16:59 vs 17:00, they shouldn't be that
> >> picky, i.e. one should show the knowledge, rather than ability to
> >> memorize stuff. :-)
> >>
> >> IMO the first case shows more knowledge cause one cannot use defaults
> >> there, with there second one it is easy to memorize. So it could be
> >> thought as "easy 3 points" or "hard 3 points" to get on the lab. :-)
> >>
> >> Sorry if my post took too much time and energy to get through. :-) It
> >> would be actually interesting to research a more general task "M flaps
> >> in N secs". But not this time. :-)
> >>
> >> Have a good one,
> >> A.
> >>
> >> Scott Morris wrote:
> >>
> >>> IMHO, I'd pick a suppress value of 1 more than 2x the penalty in this
> >>> case. Instead of 3000, use 2001.  Even sliding down, statistically
> with 3
> >>> flaps in 30 seconds, no matter where on the scale of half-life you
> are,
> >>> that will always work.
> >>>
> >>> HTH,
> >>>
> >>>
> >>> Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713,
> JNCIE
> >>> #153, CISSP, et al.
> >>> CCSI/JNCI-M/JNCI-J
> >>> IPExpert VP - Curriculum Development
> >>> IPExpert Sr. Technical Instructor
> >>> smorris@xxxxxxxxxxxx
> >>> http://www.ipexpert.com
> >>>
> >>>
> >>>
> >>> -----Original Message-----
> >>> From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx] On Behalf
> Of
> >>> anthony.sequeira@xxxxxxxxxxx
> >>> Sent: Saturday, November 18, 2006 2:02 AM
> >>> To: dukelondon@xxxxxxxxx
> >>> Cc: hitesh@xxxxxxx; ccielab@xxxxxxxxxxxxxx
> >>> Subject: RE: IP Event Dampening
> >>>
> >>> I labbed this one up as this post suggests and learned that he was
> indeed
> >>> correct about how the penalty moves....I am so sorry that I do not
> have
> >>> time right now to research the definitive answer <again> - but I think
> >>> you should have all the info you need now to ensure that you will get
> the
> >>> dampening behavior required given certain values.
> >>>
> >>>
> >>>
> >>> I suggest you lab this up.  With "dampen 30 1000 3000 60" the
> interface
> >>> will not dampen in 30 seconds with 3 flaps..
> >>>
> >>> True, the half life is when the value is decayed by half its original
> >>> penalty.  But since its an exponentially decaying algorithm, the
> penalty
> >>> begins decaying IMMEDIATELY.
> >>>
> >>> What this means is, if you flap the interface with dampening (dampen
> 30
> >>> 1000 3000 60) you will see the penalty at 1000 immediately, but then
> >>> querying the dampening for the interface again will indicate another
> >>> value like 893.  And again, 773, etc. until at 30 seconds the value
> will
> >>> be 500 for the first flap.
> >>>
> >>> If you flap it a second time then the penalty will be the original
> >>> decayed penalty value at that moment PLUS the new penalty value (e.g.
> >>> 1000).  And the exponential decay begins again.  Query the interface
> and
> >>> you will see the penalty between 500 and 1500 and decaying fast.  The
> >>> same holds true for a third flap.
> >>>
> >>> In short, a suppress value of 3000, as configured, will not dampen the
> >>> interface with 3 flaps in 30 seconds because the cumulative penalty
> will
> >>> be < 3000 at the half-life; guaranteed!
> >>>
> >>>
> >>>
> >>>
> >>> ________________________________
> >>>
> >>> From: Salman Abbas [mailto: dukelondon@xxxxxxxxx]
> >>> Sent: Saturday, November 18, 2006 1:40 AM
> >>> To: Sequeira, Anthony (NETg)
> >>> Cc: hitesh@xxxxxxx ; ccielab@xxxxxxxxxxxxxx
> >>> Subject: Re: IP Event Dampening
> >>>
> >>>
> >>>
> >>> Hi Hitesh,
> >>>
> >>>
> >>>
> >>> Thanks a bunch bro.
> >>>
> >>>
> >>> Hi Anthony,
> >>>
> >>>
> >>>
> >>> Thanks for the thread but what should the answer be, taking Hitesh's
> >>> reply and the thread into consideration?
> >>>
> >>> I mean dampening 15 1000 ___ 60 .
> >>>
> >>>
> >>>
> >>> Pls advise,
> >>>
> >>>
> >>>
> >>> Thanks and Regards,
> >>>
> >>>
> >>> Salman
> >>>
> >>>
> >>>
> >>> On 11/18/06, anthony.sequeira@xxxxxxxxxxx <
> anthony.sequeira@xxxxxxxxxxx
> >>>
> >>>
> >>>> wrote:
> >>>>
> >>> Careful - this feature does not work like you think - here is an
> >>> excellent thread from the archives on the subject. . . note that the
> >>> biggest surprise is how the feature uses an exponentially decaying
> >>> algorithm - jeez.....
> >>>
> >>> http://adserver.groupstudy.com/archives/ccielab/200605/msg01011.html
> >>>
> >>> Anthony J. Sequeira
> >>> #15626
> >>>
> >>>
> >>> -----Original Message-----
> >>> From: nobody@xxxxxxxxxxxxxx [mailto: nobody@xxxxxxxxxxxxxx ] On Behalf
> Of
> >>> SAVJANI, HITESH, WWCS
> >>> Sent: Friday, November 17, 2006 2:54 PM
> >>> To: Salman Abbas; ccie >> Cisco certification;
> >>> Duane.Fletcher@xxxxxxxxxxxxxxxxx
> >>> Subject: RE: IP Event Dampening
> >>>
> >>> Salman,
> >>>
> >>> Default value for the penalty is 1000 which can not be changed. Yes,
> it
> >>> increases by 1000 every time it flaps. You are probably looking at the
> >>> default suppress value which is 2000 also. However you can configure
> the
> >>>
> >>> suppress-threshold value which will decide when to suppress a route.
> You
> >>> can read more about it on the following link
> >>>
> >>> http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123tcr/1
>
> >>>
> >>> 23tip2r/ip2_c1gt.htm#wp1093971
> >>>
> >>> I am sure someone else on the group can add to this.
> >>>
> >>> HTH,
> >>>
> >>> Hitesh Savjani
> >>> CCIE # 17151
> >>>
> >>>
> >>> ________________________________
> >>>
> >>> From: Salman Abbas [mailto: dukelondon@xxxxxxxxx ]
> >>> Sent: Friday, November 17, 2006 1:57 PM
> >>> To: SAVJANI, HITESH, WWCS; ccie >> Cisco certification;
> >>> Duane.Fletcher@xxxxxxxxxxxxxxxxx
> >>> Subject: Re: IP Event Dampening
> >>>
> >>>
> >>> Hi Fletcher,
> >>>
> >>> I'm not the Sal Abbas who used to work at AT&T.
> >>>
> >>> Hi Hitesh,
> >>>
> >>> Thanks a bunch for your reply. The default value for "value to start
> >>> suppressing an interface" is 2000. I've checked that on the router.
> >>> When you say in 2 flaps, it'll become 2000, do you mean it increases
> by
> >>> 1000 every time theres a flap? Is this a documented value somewhere or
> >>> can I see this on the router? If it starts from 0, why do I always see
> a
> >>> value of 2000 in my sh dampening interface output?What do you think
> the
> >>> answer should be in the light of this fact?
> >>>
> >>> Regards,
> >>>
> >>> Salman
> >>>
> >>>
> >>> On 11/18/06, SAVJANI, HITESH, WWCS < hitesh@xxxxxxx> wrote:
> >>>
> >>>
> >>>        Salman,
> >>>
> >>>        I think if you want your interface to be suppressed after two
> >>> flaps then
> >>>        you should set the value to be 2000.
> >>>        Reason for that is it will start from 0 penalty & in 2 flaps
> will
> >>> bring
> >>>        it to 2000.
> >>>
> >>>        HTH,
> >>>
> >>>        Hitesh Savjani
> >>>        CCIE # 17151
> >>>
> >>>        -----Original Message-----
> >>>        From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx] On
> >>> Behalf Of
> >>>        Salman Abbas
> >>>        Sent: Friday, November 17, 2006 11:36 AM
> >>>        To: ccie >> Cisco certification
> >>>        Subject: IP Event Dampening
> >>>
> >>>        Hi guys,
> >>>
> >>>        I want RIP to stop interface e0/0 on my router from
> participating
> >>> in routing
> >>>        if it flaps 2 times in a *15* second period. what dampening
> values
> >>> will
> >>>        I
> >>>        have to set to achieve this?
> >>>
> >>>        interface e0/0
> >>>        dampening *15* 1000 __ 60. I think the answer would fit at the
> >>> third place
> >>>        (value to start supressing an interface) in the dampening
> command.
> >>>        However,
> >>>        Im not sure. Please help.
> >>>
> >>>
> >>>        Thanks a bunch in advance!!!
> >>>
> >>>        Cheers!
> >>>
> >>>        Salman
> >>>
> >>>
> >>>
> _______________________________________________________________________
> >>>        Subscription information may be found at:
> >>>         http://www.groupstudy.com/list/CCIELab.html
> >>>
> >>>
> _______________________________________________________________________
> >>> Subscription information may be found at:
> >>> http://www.groupstudy.com/list/CCIELab.html
> >>>
> >>>
> _______________________________________________________________________
> >>> Subscription information may be found at:
> >>> http://www.groupstudy.com/list/CCIELab.html
> >>>
> >>>
> _______________________________________________________________________
> >>> Subscription information may be found at:
> >>> http://www.groupstudy.com/list/CCIELab.html
> >>>
> >> _______________________________________________________________________
>
> >> Subscription information may be found at:
> >> http://www.groupstudy.com/list/CCIELab.html
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html