Traffic Policing

To limit traffic within a specified range and protect network resources, traffic policing discards excess traffic.

Traffic policing is implemented using the token bucket.

A token bucket has a specified capacity to store tokens. The system places tokens into a token bucket at the configured rate. If the token bucket is full, excess tokens overflow and no token is added.

When assessing traffic, a token bucket forwards packets based on the number of tokens in the token bucket. Only if there are enough tokens in the token bucket to forward packets is the traffic rate within the rate limit.

The working mechanisms of token buckets include single bucket at a single rate, dual buckets at a single rate, and dual buckets at dual rates.

Single Bucket at a Single Rate

If burst traffic is not allowed, one token bucket is used.

Figure 1 Single bucket at a single rate

In Figure 1, the bucket is called bucket C. Tc indicates the number of tokens within. A single bucket at a single rate uses the following parameters:

Committed Information Rate (CIR): indicates the rate at which tokens are put into bucket C, that is, the average traffic rate permitted by bucket C.
Committed burst size (CBS): indicates the capacity of bucket C, that is, maximum volume of burst traffic allowed by bucket C each time.

The system places tokens into the bucket at the CIR. If Tc is less than the CBS, Tc increases. If Tc is greater than or equal to the CBS, Tc remains unchanged.

B indicates the size of an arriving packet:

If B is less than or equal to Tc, the packet is colored green, and Tc decreases by B.
If B is greater than Tc, the packet is colored red, and Tc remains unchanged.

Dual Buckets at a Single Rate

Dual buckets at a single rate use A Single Rate Three Color Marker (srTCM) defined in RFC 2697 to assess traffic and mark packets in green, yellow, and red based on the assessment result.

Figure 2 Dual buckets at a single rate
click to enlarge

As shown in Figure 2, the two buckets are called bucket C and bucket E. Tc indicates the number of tokens in bucket C, and Te indicates the number of tokens in bucket E. Dual buckets at a single rate use the following parameters:

CIR: indicates the rate at which tokens are put into bucket C, that is, average traffic rate permitted by bucket C.
CBS: indicates the capacity of bucket C, that is, maximum volume of burst traffic allowed by bucket C each time.
Excess burst size (EBS): indicates the capacity of bucket E, that is, maximum volume of excess burst traffic allowed by bucket E each time.

The system places tokens into the bucket at the CIR:

If Tc is less than the CBS, Tc increases.
If Tc is equal to the CBS and Te is less than the EBS, Te increases.
If Tc is equal to the CBS and Te is equal to the EBS, Tc and Te do not increase.

B indicates the size of an arriving packet:

If B is less than or equal to Tc, the packet is colored green, and Tc decreases by B.
If B is greater than Tc and less than than or equal to Te, the packet is colored yellow and Te decreases by B.
If B is greater than Te, the packet is colored red, and Tc and Te remain unchanged.

Dual Buckets at Dual Rates

Dual buckets at dual rates use A Two Rate Three Color Marker (trTCM) defined in RFC 2698 to assess traffic and mark packets in green, yellow, and red based on the assessment result.

Figure 3 Dual buckets at dual rates
click to enlarge

As shown in Figure 3, the two buckets are called bucket P and bucket C. Tp indicates the number of tokens in bucket P, and Tc indicates the number of tokens in bucket C. Dual buckets at dual rates use the following parameters:

Peak information rate (PIR): indicates the rate at which tokens are put into bucket P, that is, maximum traffic rate permitted by bucket P. The PIR must be greater than the CIR.
CIR: indicates the rate at which tokens are put into bucket C, that is, average traffic rate permitted by bucket C.
Peak burst size (PBS): indicates the capacity of bucket P, that is, maximum volume of burst traffic allowed by bucket P each time.
CBS: indicates the capacity of bucket C, that is, maximum volume of burst traffic allowed by bucket C each time.

The system places tokens into bucket P at the PIR and places tokens into bucket C at the CIR:

If Tp is less than the PBS, Tp increases. If Tp is greater than or equal to the PBS, Tp remains unchanged.
If Tc is less than the CBS, Tc increases. If Tc is greater than or equal to the CBS, Tp remains unchanged.

B indicates the size of an arriving packet:

If B is greater than Tp, the packet is colored red.
If B is greater than Tc and less than or equal to Tp, the packet is colored yellow and Tp decreases by B.
If B is less than or equal to Tc, the packet is colored green, and Tp and Tc decrease by B.

Implementation of Traffic Policing

Figure 4 Traffic policing components

As shown in Figure 4, traffic policing involves the following components:

Meter: measures the network traffic using the token bucket mechanism and sends the measurement result to the marker.
Marker: colors packets in green, yellow, or red based on the measurement result received from the meter.
Action: performs actions based on packet coloring results received from the marker. The following actions are defined:
- Pass: forwards packets that meet network requirements.
- Remark + pass: changes the local priorities of packets and forwards them.
- Discard: drops packets that do not meet network requirements.
By default, green and yellow packets are forwarded, while red packets are discarded.

If the rate of a type of traffic exceeds the threshold, the device reduces the packet priority. It then either forwards the packets or directly discards them, based on traffic policing configuration. By default, the packets are discarded.