A message flood can begin when a message counter is anywhere between zero to MSGTHRESH; for example, zero, one, or equal to MSGTHRESH.

• If the message counter is zero, the first message of the flood will cause the timestamp to be stored and MSGTHRESH messages later (assuming this occurs in less than INTVLTIME), cause the threshold exceeded message to be issued and intensive mode to be entered. For this case, only MSGTHRESH messages are required to enter intensive mode.
• If the message counter is one, the timestamp marking the beginning of the interval has already been stored, and after MSGTHRESH-1 messages have been counted and the ending timestamp acquired, the difference between the timestamps may not cause intensive mode to be entered. If a flood is underway, the next MSGTHRESH number of flood messages will cause intensive mode to be entered. In this case, it will take 2 x MSGTHRESH - 1 flood messages to cause intensive mode to be entered.
• If the message counter is already at MSGTHRESH, the first flood message will cause the ending timestamp to be stored, and the difference in timestamps will probably cause intensive mode to not be entered. However, the next MSGTHRESH flood messages will cause intensive mode to be entered. So in this case, it will take MSGTHRESH + 1 messages to cause intensive mode to be entered.
• If the message counter is between one and MSGTHRESH, it will take 2 x MSGTHRESH - n messages to cause intensive mode to be entered, where "n" is the number of messages already counted.

The bottom line is that the triggering of intensive mode may not occur precisely after MSGTHRESH flood messages have occurred.