Theoretical foundations and architecture
QoS traffic conditioning relies on two mechanisms, policing and shaping, together with congestion-avoidance algorithms. 1. Policing limits the rate to the Committed Information Rate (CIR): traffic beyond the allowed burst sizes (Bc/Be) is dropped or re-marked with a higher drop precedence. No queue is used, so no delay is added; policing is typically applied at the ingress from the customer to enforce the contract. 2. Shaping buffers excess packets in memory and releases them at the configured rate. It adds variable delay and jitter but smooths TCP losses, so it is used on egress towards interfaces and subscribers with a lower rate. 3. Congestion avoidance: WRED mitigates TCP global synchronization. As buffers fill past the thresholds, WRED randomly drops packets of lower-priority classes before the queue overflows, so senders slow down gradually.
Three different mechanisms that are often confused
Classification and marking decide which class a packet belongs to (lesson 1). Conditioning (policing and shaping) limits the rate of a class or a customer. Scheduling and drop management decide which packet leaves onto the link next and which one is discarded when a queue fills up. These are three independent processing stages: marking creates neither bandwidth nor priority until a queue is configured on the output, and a queue without a rate limit will not protect other customers from an overloaded customer.
Token bucket: the common model of policing and shaping
A token bucket is described by a refill rate CIR (bit/s) and a capacity Bc (bytes). Every byte sent costs a token; as long as there are enough tokens for the packet, it conforms to the profile. The interval Tc = Bc / CIR is the time in which the bucket refills completely. Example: CIR 50 Mbit/s = 6.25 MB/s; with Bc 62,500 bytes Tc is 10 ms, and the customer can send a burst of up to 62,500 bytes (about 41 packets of 1500 bytes) at port speed, after which the rate falls to CIR. Be (excess burst) adds a second capacity for the three-color model.
A policer does not wait when tokens run out: the packet is dropped or re-marked. There is no buffer and no added delay, but TCP reacts to the losses. For a TCP flow the capacity Bc must be at least CIR x RTT: at CIR 50 Mbit/s and RTT 20 ms that is 125,000 bytes; with Bc of 62,500 bytes a single flow will not reach CIR because of drops. A shaper queues the packet when tokens run out and releases it when tokens accumulate: fewer losses, but a delay of up to queue depth / CIR appears. A queue of 64 packets of 1500 bytes at 100 Mbit/s gives at most 7.7 ms; increasing the queue to 1000 packets gives 120 ms and ruins voice in the same class.
| Parameter | Policing | Shaping |
|---|---|---|
| When tokens run out | Drop or remark | Buffering and delay |
| Delay and jitter | None (no buffer) | Up to queue / CIR |
| Direction | Usually ingress (contract at the demarcation) | Usually egress (to the link speed) |
| Effect on TCP | Losses and a sawtooth rate | Smoothing, more delay |
| State kept | Tokens only | Tokens and a queue |
Two-color and three-color policies
A single bucket gives two outcomes: conforms or not (two-color). RFC 2697 (srTCM, single-rate three-color) adds a second bucket Be: a packet is green if it fits in Bc, yellow if it fits in Be, and red if it fits nowhere. RFC 2698 (trTCM, two-rate three-color) uses two rates: CIR/CBS and PIR/PBS; red is exceeding PIR, yellow is exceeding CIR but not PIR, green is everything else. Example: CIR 50 Mbit/s, PIR 100 Mbit/s, the customer sends 80 Mbit/s: 50 Mbit/s is green, 30 Mbit/s is yellow, nothing is red. Typical actions: green is sent with the original TC, yellow is sent with a lowered TC (or drop precedence) and is dropped first on congestion, red is dropped. The color-blind mode ignores the color already set by a previous node; color-aware takes it into account.
Schedulers
FIFO serves packets in order of arrival, with no distinction between classes. Strict Priority (PQ) always serves the highest queue first: low delay, but with unlimited bandwidth voice starves everything else. WFQ/DRR/DWRR divide bandwidth in proportion to weights: DWRR serves queues round-robin and keeps a "deficit counter" so that packets of different sizes do not distort the proportions. CBWFQ (Cisco) gives a class a guaranteed bandwidth and divides the remainder by weight. LLQ = CBWFQ + one strict priority queue: on Cisco priority is limited by a policer, but only during congestion (on a free link voice may exceed the configured rate), so protection limits not only the queue but also the input. On Junos the priority queue is set with priority strict-high and the others share bandwidth through transmit-rate; limiting the priority queue requires separate configuration (rate-limit or an input policer).
A typical allocation for 100 Mbit/s: voice 10% (10 Mbit/s) in the priority queue, video 20%, critical data 30%, and the rest (Best Effort) gets the remainder together with unused bandwidth. Guarantees work only under congestion: on an uncongested link every class uses the free bandwidth.
Drop management: tail drop, RED and WRED
When a queue fills up, tail drop discards the most recently arrived packets of all flows at once; all TCP sessions reduce their window simultaneously, then increase it simultaneously (global synchronization), and the link works in a sawtooth. RED starts dropping packets randomly in advance: by the exponentially averaged queue length avg = avg*(1 - 2^-n) + current*2^-n (on Cisco n is 9 by default). Below the min threshold nothing is dropped; between min and max the probability grows linearly up to 1/denominator; above the max threshold everything is dropped. Example: min 20, max 40 packets, denominator 10: at avg 30 the drop probability is 5%. WRED has a separate profile for each drop precedence level or color: AFx3 and yellow packets are dropped earlier than AFx1 and green ones. WRED is applied only to TCP-like classes (data, Best Effort); UDP voice and video do not react to drops, and they are protected by priority and a policer.
