Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
326
Views
0
Helpful
2
Replies

RMON

Go to solution
Just Kennie
Level 1
Level 1

‎06-09-2009 09:24 AM - last edited on ‎03-25-2019 03:24 PM by Community Manager

Getting a bit confused here when to use "delta" or "absolute" during rmon configuration.

What need to be used in the below scenerio........

• In order to help detect possible flood attacks in the future configure R2 to

generate an SNMP trap when the interface input unicast packets

(ifEntry.11.1) value rises more than 15000 per minute, and when the

value falls back below 5000 per minute.

• The sampling interval should be every sixty seconds.

• When the 15000 threshold is breached an event should be generated that

reads “Above 15000 for ifInUcastPkts”.

• When the value falls back to 5000 an event should be generated that

reads “Below 5000 for ifInUcastPkts”.

• The server to send these SNMP traps to is 183.X.17.100.

• This server will be expecting the community string to be XXXX.

Please expalin the diffrence, I will understand.

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
Laurent Aubert
Cisco Employee
Cisco Employee

‎06-09-2009 01:02 PM

Hi,

Delta means the difference between when you are reading the data and the value of the previous reading.

Absolute refer to the value of the MIB variable when you read it.

In your case, it's a delta value because you need to send the trap when the counter rise or increase more than 15000 packets. We don't care of its actual value, we just check: actual value - previous value >= 15000

You should have use absolute if the question was more like " send the trap when the counter reach 1000000" for example.

HTH

Laurent.

View solution in original post

0 Helpful
2 Replies 2

Go to solution
Laurent Aubert
Cisco Employee
Cisco Employee

‎06-09-2009 01:02 PM

Hi,

Delta means the difference between when you are reading the data and the value of the previous reading.

Absolute refer to the value of the MIB variable when you read it.

In your case, it's a delta value because you need to send the trap when the counter rise or increase more than 15000 packets. We don't care of its actual value, we just check: actual value - previous value >= 15000

You should have use absolute if the question was more like " send the trap when the counter reach 1000000" for example.

HTH

Laurent.

0 Helpful

Go to solution
Thotsaphon Lueangwattanaphong
Level 7
Level 7
In response to Laurent Aubert

‎06-10-2009 01:24 AM

Hi,

What I have in mind is as follows:

Normally we use an “absolute” key-word for the value that gets increasing and decreasing. F.e. CPU/Memory utilization.

Normally we use a “delta” key-word for the value that gets only increasing. F.e. Port Utilization. CRC errors.

Toshi

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card