Reset Search
 

 

Article

What is the use of hysteresis value in a clear flow rule

« Go Back

Information

 
TitleWhat is the use of hysteresis value in a clear flow rule
Question
What is the use of hysteresis in a clear flow rule. 
 
Environment
  • EXOS
  • Summit and BlackDiamond switches
  • Clear-flow
Answer
As per the below example.The Notify_Broadcast rule will be triggered when the broadcast packets exceeds 500 for the period of 1 second. 

After the delta statement is true, the value of the threshold is adjusted so that a change smaller than the hysteresis value will not cause the statement to become false. For statements using the REL_OPER > or >=, the hysteresis value is subtracted from the threshold; for < or <=, the hysteresis value is added to the threshold.

The Rule Notify_Broadcast until the Delta value falls below (Delta -hysteresis) (500-50) = 450 

entry Count_Broadcast { 
if match all { 
    ethernet-destination-address ff:ff:ff:ff:ff:ff ;
}
then {
    count countbcast;
}
}
entry Notify_Broadcast { 
if match all { 
    delta countbcast > 500 ;
    period 1 ;
    hysteresis 50;
}
then {
    syslog "Broadcast Flooding Detected on Port $port. Delta counter value is $ruleValue now" NOTI 60 ;
}
else {
    syslog "Broadcast Flooding Cleared on Port $port" NOTI 60 ;
}
}
Additional notes
More information on how to configure clear flow can be found in the concepts guide under CLEAR-Flow section 
Where can I find documentation for Extreme products?

Please refer to this article for sample clear flow rule 
Using clear-flow to log when there is malicious traffic to a destination server coming into the switch

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255