Traffic shaping and policing: CIR, Bc, Be, token buckets and Cisco IOS configuration

Why limit traffic at all?

Service providers often sell a rate lower than the physical port, for example a 200 Mbps service on a 1 Gbps fibre handoff. They police at that rate and drop anything above it. On your side, you shape to the same rate so that you decide what waits, rather than letting the provider drop at random. Inside your own network, you might police guest Wi-Fi to 20 Mbps or limit a backup system that would otherwise fill the WAN.

Token buckets and the key terms

Routers send at the full line rate of the interface; they cannot send "slower bits". A rate limit is achieved by sending for part of each time interval and then pausing. The model is a token bucket: tokens, each worth one bit or byte, drip into a bucket at the agreed rate, and a packet may only be sent if enough tokens are available.

Example: with a CIR of 10 Mbps and Bc of 100,000 bits, Tc is 10 ms. In each 10 ms the router may send 100,000 bits at line rate, then must wait for the next interval. A smaller Tc gives smoother output, which suits voice; IOS chooses Bc automatically if you do not set it.

Shaping on Cisco IOS

• shape average: sends up to Bc per interval, plus Be if credit was saved, keeping the long-term average at the CIR. Allowing Be up to the interface speed lets short bursts out quickly after an idle period.
• shape peak: sends Bc + Be in every interval, so the actual rate is CIR x (1 + Be/Bc). It is used where a provider allows bursting above the committed rate when capacity is free.

policy-map SHAPE-TO-ISP
 class class-default
  shape average 200000000
  service-policy WAN-QUEUING
interface GigabitEthernet0/0
 service-policy output SHAPE-TO-ISP

Shaping works only on output, adds delay while packets wait, and is usually combined with a child queuing policy, as above.

Legacy: Frame Relay traffic shaping

Frame Relay, a WAN service largely retired by the 2010s, had its own shaping using map classes per virtual circuit, with commands such as frame-relay cir and frame-relay traffic-shaping. The concepts of CIR, Bc and Be come from that era. Today the same job is done with MQC shapers on Ethernet and MPLS services.

Policing on Cisco IOS

A policer never buffers. Each packet is conforming, exceeding or, with three colours, violating, and each colour gets an action: transmit, drop, or re-mark and transmit.

• Single-rate two-colour: one CIR and Bc; conform or exceed.
• Single-rate three-colour (RFC 2697): adds Be, giving a "violate" colour for traffic beyond the excess burst.
• Two-rate three-colour (RFC 2698): a CIR and a higher PIR. Below CIR conforms, between CIR and PIR exceeds, above PIR violates.

policy-map GUEST-LIMIT
 class class-default
  police cir 20000000 pir 30000000
   conform-action transmit
   exceed-action set-dscp-transmit cs1
   violate-action drop
interface GigabitEthernet0/2.50
 service-policy input GUEST-LIMIT

Because policers drop without warning, TCP sessions see sudden loss and back off sharply, producing a "sawtooth" pattern. For TCP-heavy traffic, shaping or a generous burst size gives better throughput.

Real-world example: a small accountancy firm bought a 100 Mbps internet service delivered on a 1 Gbps port. Uploads to its cloud document system were slow and erratic, and video calls broke up during uploads. The provider's policer was dropping everything above 100 Mbps. An engineer shaped the router's outbound traffic to 95 Mbps with a child policy giving video calls priority. Uploads became steady and calls stayed clear, because the firm's router now decided what waited.