This read-only value specifies which action the switch takes when traffic exceeds the rising threshold: shutdown(1) to disable the port, or filter(2) to apply a policy filter for the offending packet type, defaulting to shutdown. An admin checks it to know whether a storm event on that interface will take the port completely offline or merely filter the excess traffic while keeping the port up. For example, an admin who prefers to keep a critical uplink port up during a storm event would expect this to be configured to filter(2) rather than left at the default shutdown(1).