IRP can be configured to automatically add throttling Flowspec policies for prefixes that started using abnormal volumes of traffic. This feature can be used only if your network has Flowspec capabilities. Refer Flowspec policies for details about Flowspec.
In case thresholds for excessive bandwidth use are set to very aggressive levels IRP can create large numbers of Flowspec policies.This feature can be described as:
- configure excess threshold and throttling multipliers
- periodically determine current and average prefix bandwidth usage for this hour of the day
- verify if current usage exceeds the average by a larger factor then the threshold multiplier
- rate-limit excessive bandwidth usage prefixes at their average use times throttling multiplier.
Past throttling rules are revised if/when prefix abnormal usage pattern ends.
For example, when a prefix usually consumes 1-2Mbps of traffic and its current bandwidth spikes tenfold and the spike is sustained for a significant period of time a throttling rule limiting usage by this prefix at 5-6Mbps will still offer ample bandwidth for normal service use and will also protect other services from network capacity starvation.
Refer Core configuration for details.
