Count Expression

A CLEAR-Flow count expression compares a counter with the threshold value. The following is the syntax for a CLEAR-Flow count expression:

count <counterName> REL_OPER <countThreshold> ;
hysteresis <hysteresis> ;

The value of countThreshold and hysteresis can be specified as floating point numbers. The count statement specifies how to compare a counter with its threshold. The counterName is the name of an ACL counter referred to by an ACL rule entry and the countThreshold is the value compared with the counter. The REL_OPER is selected from the relational operators for greater than, greater than or equal to, less than, or less than or equal to (>, >=, <, <=).

The hysteresis hysteresis statement is optional and sets a hysteresis value for the threshold. After the count statement is true, the value of the threshold is adjusted so that a change smaller than the hysteresis value will not cause the statement to become false. For statements using the REL_OPER > or >=, the hysteresis value is subtracted from the threshold; for < or <=, the hysteresis value is added to the threshold.

Following is an example of a count expression used in a CLEAR-Flow rule:

entry cflow_count_rule_example  {
if { count counter1 > 1000000 ;
period 10 ;
}
Then {
<actions>;
}
}

Actions are discussed in CLEAR-Flow Rule Actions.

Count Expression Evaluation Example is an example of evaluating the CLEAR-Flow count expression above multiple times. Notice that the rule is not triggered until evaluation 3, when the value of the counter is greater than 1,000,000.

Table 1. Count Expression Evaluation Example
Evaluation	counter1 value	Rule triggered?
1	384625	No
2	769250	No
3	1153875	Yes
4	1538500	Yes

See Count Expression Example for a full example of an ACL and a CLEAR-Flow rule using a count expression.