Course contents

Chapter 11: IP Services on IOSLesson 9 of 10

QoS policing and shaping

Policing drops, shaping delays: the token bucket, CIR and burst, and police and shape examples in MQC.

Intermediate · 9 min read

Technical definition

Policing and shaping are the two ways to enforce a rate limit. Policing drops or re-marks traffic that exceeds the committed rate. Shaping holds the excess in a queue and sends it later.

The same limit, two behaviours

Policing drops the excess; shaping delays it
Policing drops the excess; shaping delays itBoth enforce a rate limit. Policing discards or re-marks traffic above the committed rate, leaving sharp edges and causing retransmissions. Shaping buffers the excess and sends it later, smoothing the output at the cost of added delay.PolicingAbove the dashed line is dropped.ShapingExcess waits in a queue, leaves later.Policingno delay · drops cause retransmits · in or outShapingadds delay · smooth output · outbound only
Policing can be applied inbound or outbound and needs no queue memory. Shaping is outbound only. Use shaping toward a provider that polices you, so you control what is dropped.
Policing and shaping compared
Policing and shaping compared; Policing; Shaping. Traffic above the rate: Dropped, or re-marked to a lower priority Buffered and sent later Delay: None added Added by the queue Output shape: Bursty with sharp edges Smooth TCP effect: Drops cause retransmits and slow down Gentler Direction: Inbound or outbound Outbound only Memory: Almost none Needs queue buffers Typical use: Provider enforcing a contract, limiting a class Customer matching a slower WAN or provider ratePolicingShapingTraffic above the rateDropped, or re-marked to a lowerpriorityBuffered and sent laterDelayNone addedAdded by the queueOutput shapeBursty with sharp edgesSmoothTCP effectDrops cause retransmits and slow downGentlerDirectionInbound or outboundOutbound onlyMemoryAlmost noneNeeds queue buffersTypical useProvider enforcing a contract,limiting a classCustomer matching a slower WAN orprovider rate

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Choose by what you can tolerate: drops with policing, or delay with shaping.

The token bucket in one paragraph

Both tools use a token bucket. Tokens are added at the committed rate. Sending a packet spends tokens equal to its size. If enough tokens are available, the packet conforms. If not, a policer drops or re-marks it, while a shaper holds it until tokens arrive. A larger burst size lets short bursts pass without penalty.

Configuring both

Example commands and output on this page were written from Cisco IOS documentation and generally described behaviour. They were not captured from a live device, so prompts and details can differ on your platform and version.

! Policing: limit a class to 10 Mb/s, drop the excess policy-map POLICE-10M class class-default police 10000000 conform-action transmit exceed-action drop ! Shaping: smooth outbound traffic to 10 Mb/s policy-map SHAPE-10M class class-default shape average 10000000 interface GigabitEthernet0/1 service-policy output SHAPE-10M

Rates are in bits per second. Policing can use service-policy input or output; shaping is output only. Class names and parameter syntax depend on the platform.

Verifying

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show policy-map interface GigabitEthernet0/1
GigabitEthernet0/1
  Service-policy output: SHAPE-10M
    Class-map: class-default (match-any)
      12000 packets, 9000000 bytes
      shape (average) cir 10000000, bc 40000, be 40000
      Queue depth 3, packets delayed 410, bytes delayed 300000
Example output. Packets delayed is the sign of shaping at work. With a policer you would see conformed and exceeded counters instead.

Test yourself

Predict · scenario 1

Which tool delays excess traffic in a queue instead of discarding it?

Predict · scenario 2

In which direction can shaping be applied?

Predict · scenario 3

Your provider polices your link at 10 Mb/s but the interface runs at 100 Mb/s. What should you configure outbound?

FAQ

When should I use shaping instead of policing?
When the provider polices you at a rate below the link speed. If you shape to that rate first, you decide what waits and what is dropped, instead of the provider dropping traffic at random.
Which direction can each be applied?
Policing can be applied inbound or outbound. Shaping is applied outbound only, because it needs to buffer packets before sending them.
What are CIR, Bc and Be?
CIR is the committed information rate in bits per second. Bc is the committed burst, the bits allowed per interval. Be is the excess burst, which lets bursts exceed Bc briefly before being exceeded or violated.