Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 383 / 698

Adding CLEAR-Flow Rules to ACLs
ExtremeWare XOS 11.3 Concepts Guide
383
the counters is near the threshold. If the hysteresis value is greater than the threshold value, the
hysteresis value will be set to zero.
In Table 54 is an example of evaluating the CLEAR-Flow delta-ratio expression above multiple times.
Notice that the rule is not triggered at the second evaluation because both counters have not yet reached
the min-value of 100. The rule first triggers at evaluation 4, when ratio of the two counters exceeds 5.
Once the rule is triggered, it remains triggered until the ratio value is less than 4 (the original threshold
minus the hysteresis), at evaluation 6. At evaluation 8, the rule is again triggered when the ratio reaches
5. The rule will remain triggered until the ratio drops below 4.
See the section, “Delta-Ratio Expression Example” on page 392 , for a full example of an ACL and a
CLEAR-Flow rule using a delta-ratio expression.
Rule-True-Count Expression
A CLEAR-Flow rule-true-count expression compares how many times a CLEAR-Flow rule is true with a
threshold value. One use is to combine multiple rules together into a complex rule. The following is the
syntax for a CLEAR-Flow rule-true-count expression:
rule-true-count <ruleName> REL_OPER <countThreshold> ;
The
rule-true-count
statement specifies how to compare how many times a CLEAR-Flow rule is true
with the expression threshold. The
<ruleName>
is the name of the CLEAR-Flow rule to monitor and the
<countThreshold>
is the value compared with the number of times the rule is true. The
REL_OPER
is
selected from the relational operators for greater than, great than or equal to, less than, or less than or
equal to (>, >=, <, <=).
For example, the following delta-ratio expression:
rule-true-count cflow_count_rule_example >= 5 ;
will only be true after the CLEAR-Flow rule cflow_count_rule_example has been true at least five times. If
the rule cflow_count_rule_example becomes true and remains true, and the period for
cflow_count_rule_example is the default five seconds, the rule would have to be true for at least 20
seconds before the rule-true-count expression will become true. If the period of the rule
cflow_count_rule_example is 10 seconds, it will need to be true for at least 40 seconds before the rule-
true_count expression becomes true.
Table 54: Delta-Ratio Expression Evaluation Example
Evaluation
counter1
value counter1
delta counter2
value counter2
delta
Ratio
Rule
triggered?
1 110 N/A 20 N/A N/A No
2 537 427 90 70 6 No
3 1478 941 325 235 4 No
4 3953 2475 737 412 6 Yes
5 6261 2308 1307 570 4 Yes
6 8574 2313 2078 771 3 No
7 12171 3597 2977 899 4 No
8 17511 5340 4042 1065 5 Yes