CLEAR-Flow
ExtremeWare XOS 11.3 Concepts Guide
380
Delta Expression
A CLEAR-Flow delta expression computes the difference from one sample to the next of a counter
value. This difference is compared with the threshold value. The following is the syntax for a CLEAR-
Flow delta expression:
delta <counterName> REL_OPER <countThreshold> ;
hysteresis <hysteresis> ;
The delta expression specifies how to compare the difference in a counter value from one sample to the
next with its threshold. The
<counterName> is the name of an ACL counter referred to by an ACL rule
entry and the
<countThreshold> is the value compared with the difference in the counter from one
sample to the next. The
REL_OPER is selected from the relational operators for greater than, great than or
equal to, less than, or less than or equal to (>, >=, <, <=).
The
hysteresis <hysteresis> statement is optional, and sets a hysteresis value for the threshold.
After the
delta statement is true, the value of the threshold is adjusted so that a change smaller than
the hysteresis value will not cause the statement to become false. For statements using the REL_OPER >
or >=, the hysteresis value is subtracted from the threshold; for < or <=, the hysteresis value is added to
the threshold.
For example, the following delta expression:
delta counter1 >= 100 ;
hysteresis 10 ;
will only be true after the delta of the counter reaches at least 100. At the time it becomes true, the
hysteresis value is subtracted from the threshold (setting the threshold to 90). With the threshold now at
90, the condition would stay true until the delta of the counter becomes less than 90.
If the expression becomes false, the threshold is reset to its original value. You would use the hysteresis
value to prevent the expression from vacillating between the true and false states if the difference
between the counter values is near the threshold. If the hysteresis value is greater than the threshold
value, the hysteresis value will be set to zero.
In Table 52 is an example of evaluating the CLEAR-Flow delta expression above multiple times. Notice
that the rule is not triggered until evaluation 4, when the delta value (the change in the counter value
from one evaluation to the next) is greater than or equal to 100. Once the rule is triggered, it remains
triggered until the delta value is less than 90 (the original threshold minus the hysteresis), at evaluation
7. At evaluation 9, the rule is again triggered when the delta reaches 100. The rule will remain triggered
until the delta drops below 90.
Table 52: Delta Expression Evaluation Example
Evaluation counter1 value Delta value Rule triggered?
1 397 N/A No
2 467 70 No
3 547 80 No
4 657 110 Yes
5 757 100 Yes
6 852 95 Yes
7 932 80 No
8 1031 99 No
9 1131 100 Yes