Delta Rule Type Example - Extreme Networks ExtremeWare XOS Guide Manual

CLEARFlow
Since there is no period configured for the
entry acl_rule1 {
if {
destination-address 192.168.16.0/24;
destination-port 2049;
protocol tcp;
} then {
count counter1;
}
}
entry cflow_count_rule_example
if { count counter1 > 1000000 ;
period 10 ;
}
then {
snmptrap 123 "Traffic on acl_rule1 exceeds threshold";
deny acl_rule1;
}
}

Delta Rule Type Example

In this example, every 10 seconds the CLEARFlow agent will request the counter1 statistics from the
hardware. After it receives the counter value, it will then evaluate the rule. If the delta (change) of the
counter1 value from the last sampled value 10 seconds ago is greater than or equal to 1000 packets, the
CLEARFlow agent will send a trap message to the SNMP master, and change the ACL acl_rule1 to move
the traffic to QP3. In addition, reduce the peak rate to 5 Kbps on QP3. As long as the delta continues to
be greater than or equal to 1000 packets, the CLEARFlow agent will repeatedly send a trap message
every 120 seconds. Once the delta falls below the threshold, the agent will execute the two actions in the
portion; it will send a single SNMP trap message, return the traffic to QP1, and rest QP3 to its
else
original bandwidth.
entry acl_rule1 {
if {
destination-address 192.168.16.0/24;
destination-port 2049;
protocol tcp;
} then {
count counter1;
}
}
entry cflow_delta_rule_example
if { delta counter1 >= 1000 ;
period 10 ;
} then {
snmptrap 123 "Traffic to 192.168.16.0/24 exceed rate limit" 120;
qosprofile acl_rule1 QP3;
cli "configure qosprofile qp3 peak_rate 5 K ports all" ;
} else {
ExtremeWare XOS 11.1 Concepts Guide
statement, the message is sent only once.
snmptrap
{
{
262