A message flood can begin when a message counter
is
anywhere between zero to MSGTHRESH; for example, zero, one, or equal
to MSGTHRESH.
- If the message counter is zero, the first message of the flood
will cause the timestamp to be stored and MSGTHRESH messages later
(assuming this occurs in less than INTVLTIME), cause the threshold
exceeded message to be issued and intensive mode to be entered. For
this case, only MSGTHRESH messages are required to enter intensive
mode.
- If the message counter is one, the timestamp marking the beginning
of the interval has already been stored, and
after MSGTHRESH-1 messages have been counted and the ending timestamp
acquired, the difference between the timestamps
may not cause intensive mode to be entered. If a flood is underway,
the next MSGTHRESH number of flood messages will cause intensive mode
to be entered. In this case, it will take 2 x MSGTHRESH - 1 flood
messages to cause intensive mode to be entered.
- If the message counter is already at MSGTHRESH, the first flood
message will cause the ending timestamp to be stored, and the difference
in timestamps will probably cause intensive mode to not be entered.
However, the next MSGTHRESH flood messages will cause intensive mode
to be entered. So in this case, it will take MSGTHRESH + 1 messages
to cause intensive mode to be entered.
- If the message counter is between one and MSGTHRESH, it will take
2 x MSGTHRESH - n messages to cause intensive mode to be entered,
where "n" is the number of messages already counted.
The bottom line is that the triggering of intensive mode may
not occur precisely after MSGTHRESH flood messages have occurred.