LFCE 85 🐧 Traffic Control — Concepts - KandZ

⏱️ Estimated read: 12 min | |

Traffic control is the kernel subsystem that decides how packets are queued, scheduled, shaped, and dropped as they leave or enter a network interface. The previous chapters covered the firewall, which decides whether a packet is allowed to pass; this chapter covers the subsystem that decides when and how fast it passes. The LFCE exam expects the candidate to understand the tools that manage bandwidth, prioritize latency-sensitive traffic, and mitigate congestion, and tc is the userspace utility that configures the kernel’s traffic control structures .

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The subsystem is built from three kinds of objects: qdiscs, classes, and filters. A qdisc (queueing discipline) is attached to an interface and holds the packets that are waiting to be transmitted. A class is a subdivision inside a classful qdisc, and a filter is the rule that decides which class a packet belongs to. The three objects form a tree: the root qdisc is attached to the interface, its classes are the branches, and the filters are the rules that route packets into the branches . The processing happens on egress by default, and ingress policing is a separate mechanism that is more limited.

Key point: Shaping and scheduling happen on egress, where the kernel controls the transmission rate. Policing happens on ingress, where the kernel can only drop or mark packets that arrive too fast, because the remote sender controls the rate . The tc command configures qdiscs, classes, and filters, and the objects are identified by handles in the major:minor format. The pfifo_fast qdisc is the default when no qdisc is configured, and it provides three priority bands based on the packet’s TOS field .

Why traffic control requires understanding the object model

The egress-versus-ingress problem.

The kernel can only shape traffic that it sends. When a packet leaves the interface, the kernel can hold it in a queue and release it at a controlled rate. When a packet arrives, the kernel cannot slow the sender down; it can only drop the packet or mark it, and the sender’s TCP stack will eventually reduce its rate. This asymmetry is the reason shaping is an egress mechanism and policing is an ingress mechanism . A configuration that tries to shape ingress traffic with a root qdisc will not work, because the qdisc is attached to the egress path.

The classful-versus-classless problem.

A classless qdisc has no subdivisions. It treats every packet the same way, and its only decision is whether to enqueue or drop. The pfifo, pfifo_fast, tbf, red, sfq, and fq_codel are classless qdiscs . A classful qdisc has classes, and each class can have its own qdisc and its own filters. The htb, cbq, and prio are classful qdiscs . The classful qdisc is necessary when different traffic types need different treatment, such as guaranteeing bandwidth to one class and limiting another.

The handle problem.

Every qdisc, class, and filter has an ID in the major:minor format. The qdisc’s ID is its handle, and the classes under it share the major number but have different minor numbers. The filter’s ID is a three-part ID that is only needed for a hashed filter hierarchy . The root handle is ffff:, and the unspecified handle is 0:. A qdisc that is expected to have children is usually assigned an explicit handle, such as 1:, so that its classes can be referenced as 1:1, 1:2, and so on .

a. The classless qdiscs

A classless qdisc is attached to the root of an interface, and it has no subclasses. It is the simplest form of traffic control, and it is used when the entire interface’s traffic should be treated uniformly.

# Show the current qdisc
tc qdisc show dev eth0

# Replace the default qdisc with tbf
tc qdisc add dev eth0 root tbf rate 10mbit burst 32kbit latency 400ms

# Replace with fq_codel for fair queueing and low latency
tc qdisc add dev eth0 root fq_codel

# Replace with red for congestion avoidance
tc qdisc add dev eth0 root red limit 1000000 min 100000 max 300000 avpkt 1000

The tbf (Token Bucket Filter) is the qdisc for slowing traffic to a precisely configured rate. It uses a token bucket that fills at the configured rate, and packets are transmitted only when tokens are available . The fq_codel qdisc combines fair queueing with the CoDel congestion control algorithm, and it is the recommended default for most interfaces because it provides good latency under load without manual tuning . The red (Random Early Detection) qdisc drops packets probabilistically before the queue is full, which prevents the synchronized retransmissions that occur when a tail-drop queue overflows .

The pfifo_fast qdisc is the default when no qdisc is configured. It has three bands, and it selects the band based on the packet’s TOS field. The bands are dequeued in order, so the higher-priority traffic is transmitted first .

b. The classful qdiscs and the hierarchy

A classful qdisc contains classes, and each class can contain another qdisc. The result is a tree, and the filters determine which branch a packet follows.

# Create an HTB qdisc with handle 1:
tc qdisc add dev eth0 root handle 1: htb default 30

# Create a class with a guaranteed rate
tc class add dev eth0 parent 1: classid 1:10 htb rate 10mbit ceil 10mbit

# Create a class with a lower rate and a ceiling
tc class add dev eth0 parent 1: classid 1:20 htb rate 5mbit ceil 10mbit

# Create a filter that directs SSH traffic to class 1:10
tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip dport 22 0xffff flowid 1:10

# Create a filter that directs HTTP traffic to class 1:20
tc filter add dev eth0 protocol ip parent 1: prio 2 u32 match ip dport 80 0xffff flowid 1:20

The htb (Hierarchy Token Bucket) qdisc is the most commonly used classful qdisc. It guarantees a minimum rate to each class and allows the class to borrow up to its ceiling when the parent has spare bandwidth . The default 30 parameter tells the qdisc which class receives the packets that are not matched by any filter.

The prio qdisc is a simpler classful qdisc. It has a fixed number of classes, and it dequeues them in order. It does not shape; it only prioritizes. The packets that are not matched by a filter go to the first class by default .

c. The filters and the flow classification

A filter is the mechanism that decides which class a packet belongs to. The u32 filter is the most common, and it matches on fields in the packet header.

# Match on destination port
tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip dport 22 0xffff flowid 1:10

# Match on source address
tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip src 192.168.1.0/24 flowid 1:20

# Match on the firewall mark set by iptables
tc filter add dev eth0 protocol ip parent 1: prio 1 handle 1 fw flowid 1:10

The u32 filter matches the packet’s fields against the specified values, and the flowid tells the qdisc which class the matching packet should be enqueued in . The fw filter matches the firewall mark that iptables or nftables has set on the packet, which is the mechanism that connects the firewall’s classification to the traffic control’s scheduling. The firewall marks the packet, and the traffic control uses the mark to select the class.

Complete Example Session

# ============================================
# PART 1: INSPECT THE CURRENT QDISC
# ============================================
tc qdisc show dev eth0
# Output shows the default qdisc (usually pfifo_fast)

# ============================================
# PART 2: REPLACE WITH A CLASSLESS QDISC
# ============================================
sudo tc qdisc add dev eth0 root fq_codel
tc qdisc show dev eth0
# Output shows fq_codel as the root qdisc

# ============================================
# PART 3: CREATE AN HTB HIERARCHY
# ============================================
sudo tc qdisc add dev eth0 root handle 1: htb default 30
sudo tc class add dev eth0 parent 1: classid 1:10 htb rate 10mbit ceil 10mbit
sudo tc class add dev eth0 parent 1: classid 1:20 htb rate 5mbit ceil 10mbit
sudo tc class add dev eth0 parent 1: classid 1:30 htb rate 1mbit ceil 10mbit

# ============================================
# PART 4: ADD FILTERS
# ============================================
sudo tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip dport 22 0xffff flowid 1:10
sudo tc filter add dev eth0 protocol ip parent 1: prio 2 u32 match ip dport 80 0xffff flowid 1:20

# ============================================
# PART 5: VERIFY THE CONFIGURATION
# ============================================
tc qdisc show dev eth0
tc class show dev eth0
tc filter show dev eth0
# Output shows the qdisc, the classes, and the filters

# ============================================
# PART 6: CHECK THE STATISTICS
# ============================================
tc -s qdisc show dev eth0
# Output shows the packets and bytes transmitted, dropped, and overlimits

# ============================================
# PART 7: CLEAN UP
# ============================================
sudo tc qdisc del dev eth0 root

The seven parts demonstrate the traffic control configuration: inspection, classless qdisc, classful hierarchy, filters, verification, statistics, and cleanup. The critical distinction is between Parts 2 and 3: the classless qdisc treats all traffic uniformly, and the classful qdisc divides the traffic into classes with different guarantees.

Quick Reference

Traffic Control Operations

Operation	Direction	Mechanism
Shaping	Egress	Rate control in a qdisc
Scheduling	Egress	Priority and fair queueing
Policing	Ingress	Drop or mark excess traffic
Dropping	Both	Discard packets

Common Qdiscs

Qdisc	Type	Purpose
`pfifo_fast`	Classless	Default; three priority bands
`tbf`	Classless	Rate limiting
`fq_codel`	Classless	Fair queueing with low latency
`red`	Classless	Congestion avoidance
`htb`	Classful	Guaranteed rates and ceilings
`prio`	Classful	Priority ordering

tc Commands

Command	Purpose
`tc qdisc add`	Add a qdisc
`tc class add`	Add a class
`tc filter add`	Add a filter
`tc qdisc show`	Show the qdisc
`tc class show`	Show the classes
`tc filter show`	Show the filters
`tc -s`	Show statistics
`tc qdisc del`	Delete a qdisc

Best Practices

✅ Do This:

# Use fq_codel as the default qdisc
tc qdisc add dev eth0 root fq_codel                            # ✅

# Use htb for guaranteed rates
tc qdisc add dev eth0 root handle 1: htb default 30            # ✅

# Use filters to classify traffic
tc filter add dev eth0 protocol ip parent 1: u32 match ip dport 22 0xffff flowid 1:10 # ✅

# Check the statistics
tc -s qdisc show dev eth0                                      # ✅

# Use the firewall mark to connect iptables and tc
tc filter add dev eth0 parent 1: handle 1 fw flowid 1:10       # ✅

❌ Don’t Do This:

# Try to shape ingress with a root qdisc
tc qdisc add dev eth0 root tbf ...    # Egress only            # ❌

# Forget the default class on htb
tc qdisc add dev eth0 root handle 1: htb    # Unclassified packets dropped # ❌

# Use a classless qdisc when per-traffic treatment is needed
tc qdisc add dev eth0 root pfifo    # No classification       # ❌

# Forget the handle when children are needed
# Classes cannot be referenced without the handle              # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Shaping has no effect on ingress	Qdisc is egress-only	Use ingress policing
Unclassified packets dropped	No `default` class on htb	Add `default` parameter
Class not found	Wrong handle or classid	Verify with `tc class show`
Filter not matching	Wrong protocol or match field	Verify with `tc filter show`
Statistics show no traffic	Qdisc is not attached to the right interface	Check `dev` parameter

Real-World Examples

1. Show the qdisc

tc qdisc show dev eth0

2. Rate limit with tbf

tc qdisc add dev eth0 root tbf rate 10mbit burst 32kbit latency 400ms

3. Fair queueing with fq_codel

tc qdisc add dev eth0 root fq_codel

4. HTB hierarchy

tc qdisc add dev eth0 root handle 1: htb default 30

5. Guaranteed rate class

tc class add dev eth0 parent 1: classid 1:10 htb rate 10mbit ceil 10mbit

6. Filter by port

tc filter add dev eth0 protocol ip parent 1: u32 match ip dport 22 0xffff flowid 1:10

7. Filter by firewall mark

tc filter add dev eth0 parent 1: handle 1 fw flowid 1:10

8. Show statistics

tc -s qdisc show dev eth0

9. Delete the qdisc

tc qdisc del dev eth0 root

10. Show classes

tc class show dev eth0

Visual

The Qdisc, Class, and Filter Tree

┌──────────────────────────────────────────────────────────────┐
│  THE THREE OBJECTS FORM A TREE                               │
│                                                              │
│  eth0 (interface)                                            │
│  └── root qdisc: htb handle 1:                               │
│      ├── class 1:10 (rate 10mbit)                            │
│      │   └── leaf qdisc: pfifo                               │
│      ├── class 1:20 (rate 5mbit)                             │
│      │   └── leaf qdisc: pfifo                               │
│      └── class 1:30 (default, rate 1mbit)                    │
│          └── leaf qdisc: pfifo                               │
│                                                              │
│  Filters:                                                    │
│  ├── dport 22 → flowid 1:10                                  │
│  └── dport 80 → flowid 1:20                                  │
│                                                              │
│  Unmatched packets → default class 1:30                      │
└──────────────────────────────────────────────────────────────┘

Egress Shaping vs Ingress Policing

┌──────────────────────────────────────────────────────────────┐
│  SHAPING IS EGRESS; POLICING IS INGRESS                      │
│                                                              │
│  Egress:                                                     │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Kernel → qdisc → interface                             │  │
│  │ The kernel holds the packet and releases it at the    │  │
│  │ configured rate.                                       │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  Ingress:                                                    │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Interface → kernel → application                       │  │
│  │ The kernel cannot slow the sender. It can only drop   │  │
│  │ or mark the packet.                                    │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Classless vs Classful

┌──────────────────────────────────────────────────────────────┐
│  CLASSLESS TREATS ALL TRAFFIC THE SAME                       │
│                                                              │
│  Classless (tbf, fq_codel, red):                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ eth0 → qdisc → transmit                                │  │
│  │ No subdivisions; no per-traffic treatment.             │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  Classful (htb, prio):                                       │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ eth0 → qdisc → class 1 → class 2 → class 3             │  │
│  │ Filters select the class; each class has its own rate. │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Userspace tool	`tc`
Core objects	qdisc, class, filter
Shaping direction	Egress
Policing direction	Ingress
Default qdisc	`pfifo_fast`
Rate-limiting qdisc	`tbf`
Low-latency qdisc	`fq_codel`
Congestion qdisc	`red`
Classful qdisc	`htb`, `prio`
Filter type	`u32`, `fw`
Handle format	`major:minor`

Key takeaways:

Traffic control has three object types. The qdisc is the queue attached to the interface, the class is a subdivision inside a classful qdisc, and the filter is the rule that decides which class a packet belongs to . The three objects form a tree, and the filters are the routing rules for the tree.
Shaping is egress; policing is ingress. The kernel can hold and release outgoing packets at a controlled rate, but it cannot slow incoming packets. Ingress policing can only drop or mark the packets that arrive too fast .
The classless qdiscs treat all traffic uniformly. tbf limits the rate, fq_codel provides fair queueing and low latency, and red drops packets probabilistically to prevent congestion. The pfifo_fast is the default and provides three priority bands .
The classful qdiscs divide traffic into classes. htb guarantees a minimum rate to each class and allows borrowing up to a ceiling. prio orders the classes by priority without shaping. The filters determine which class each packet enters .
The u32 filter matches packet fields, and the fw filter matches firewall marks. The u32 filter is used for port and address matching, and the fw filter connects the iptables classification to the traffic control scheduling .
The handle identifies the qdisc and its classes. The qdisc’s handle is its major number, and the classes share the major number with different minor numbers. The handle is required when the qdisc has children .

Remember: Traffic control is the subsystem that decides how fast packets leave an interface. The tc command configures the qdiscs, classes, and filters. The classless qdiscs treat all traffic the same, and the classful qdiscs divide it into classes with different guarantees. The filters route the packets to the classes, and the u32 and fw filters are the most common. Shaping happens on egress, and policing happens on ingress. The result is a network that can guarantee bandwidth to critical traffic, limit the rate of bulk transfers, and keep latency low under load.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!