Getting a bit confused here when to use "delta" or "absolute" during rmon configuration.
What need to be used in the below scenerio........
â¢ In order to help detect possible flood attacks in the future configure R2 to
generate an SNMP trap when the interface input unicast packets
(ifEntry.11.1) value rises more than 15000 per minute, and when the
value falls back below 5000 per minute.
â¢ The sampling interval should be every sixty seconds.
â¢ When the 15000 threshold is breached an event should be generated that
reads âAbove 15000 for ifInUcastPktsâ.
â¢ When the value falls back to 5000 an event should be generated that
reads âBelow 5000 for ifInUcastPktsâ.
â¢ The server to send these SNMP traps to is 183.X.17.100.
â¢ This server will be expecting the community string to be XXXX.
Please expalin the diffrence, I will understand.
Delta means the difference between when you are reading the data and the value of the previous reading.
Absolute refer to the value of the MIB variable when you read it.
In your case, it's a delta value because you need to send the trap when the counter rise or increase more than 15000 packets. We don't care of its actual value, we just check: actual value - previous value >= 15000
You should have use absolute if the question was more like " send the trap when the counter reach 1000000" for example.