LFCE 86 🐧 tc — Shaping and Policing - KandZ

⏱️ Estimated read: 15 min | |

Traffic control on Linux is built around two distinct operations that are often confused: shaping and policing. Shaping delays packets to enforce a rate, while policing drops packets that exceed a rate. The previous chapter introduced the qdisc, class, and filter model; this chapter focuses on the configuration of these two operations and the qdiscs that implement them. The LFCE exam expects the candidate to understand when to shape and when to police, and how the tc command configures each.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

Shaping happens on egress, where the kernel controls the transmission. The tbf qdisc is the pure shaper: it holds packets in a queue and releases them at the configured rate, buffering the excess rather than dropping it . Policing happens on ingress, where the kernel cannot slow the sender. The police action drops or marks the packets that exceed the configured rate, and it does not buffer . The two operations serve different purposes, and the choice depends on whether the goal is to slow the traffic down (shaping) or to enforce a hard limit (policing).

Key point: Shaping is egress-only and buffers excess packets. Policing works on ingress or egress and drops or marks excess packets. The tbf qdisc is a pure shaper that never schedules traffic; it throttles itself to ensure the configured rate is not exceeded . The police action is attached to a filter on the ingress qdisc, and its conform-exceed option controls what happens to the packets that exceed the rate . For TCP traffic, shaping is gentler because it triggers the sender’s congestion control without causing retransmissions.

Why shaping and policing require different approaches

The direction problem.

The kernel can only shape traffic that it sends. When a packet leaves the interface, the qdisc can hold it in a queue and release it at a controlled rate. When a packet arrives, the kernel cannot slow the remote sender down. The ingress qdisc is a special placeholder that has no queue of its own; it is a hook for the filters that attach the police action . The police action can only drop or mark the packet, and the sender’s TCP stack eventually reduces its rate in response to the loss.

The buffering problem.

Shaping buffers the excess packets and releases them later. The tbf qdisc uses a token bucket that fills at the configured rate, and packets are transmitted only when tokens are available. The excess packets wait in the queue, and the queue size is controlled by the latency or limit parameter . Policing does not buffer. The police action measures the rate and drops or marks the packets that exceed it, which means the sender must retransmit the lost packets. For TCP, the retransmission is the mechanism that reduces the rate, but it also increases the latency and the bandwidth waste.

The burst problem.

Both shaping and policing have a burst allowance. The burst parameter in the tbf qdisc is the size of the token bucket, and it determines how much traffic can be sent at the full link rate before the shaper begins to throttle . The burst parameter in the police action is the maximum allowed burst before the policer begins to drop . A burst that is too small produces excessive throttling or dropping, and a burst that is too large allows the traffic to exceed the rate for longer than intended. The correct burst value depends on the link rate and the expected traffic pattern.

a. Configuring shaping with tbf

The tbf qdisc is a classless qdisc that is attached to the root of the interface. It is the simplest way to limit the egress rate.

# Limit eth0 to 10 Mbps outbound
sudo tc qdisc add dev eth0 root tbf \
  rate 10mbit \
  burst 32kb \
  latency 400ms

The rate 10mbit sets the maximum rate. The burst 32kb sets the token bucket size, which allows a short burst at the full link rate before the shaper throttles . The latency 400ms sets the maximum time a packet can wait in the queue, which effectively controls the queue size. The tc qdisc show dev eth0 command confirms the configuration, and the tc -s qdisc show dev eth0 command shows the statistics, including the packets that were dropped because the queue was full.

The tbf qdisc can be combined with a classful qdisc for more complex configurations. The htb qdisc is the hierarchical shaper, and it allows multiple classes with guaranteed rates and ceilings.

# Create an HTB root qdisc with a default class
sudo tc qdisc add dev eth0 root handle 1: htb default 30

# Total bandwidth: 100 Mbps
sudo tc class add dev eth0 parent 1: classid 1:1 htb rate 100mbit

# High priority: guaranteed 60 Mbps, can borrow up to 100 Mbps
sudo tc class add dev eth0 parent 1:1 classid 1:10 htb rate 60mbit ceil 100mbit prio 1

# Normal: guaranteed 30 Mbps, can borrow up to 100 Mbps
sudo tc class add dev eth0 parent 1:1 classid 1:20 htb rate 30mbit ceil 100mbit prio 2

# Default: 10 Mbps
sudo tc class add dev eth0 parent 1:1 classid 1:30 htb rate 10mbit ceil 100mbit prio 3

The htb qdisc is classful, and the classes are the subdivisions of the total bandwidth. The rate is the guaranteed minimum, and the ceil is the maximum that the class can borrow when the parent has spare capacity . The prio parameter determines the order in which the classes are served when the parent has packets to send. The default 30 parameter sends the unclassified packets to class 1:30.

The filters classify the traffic into the classes. The u32 filter matches the packet fields, and the flowid points to the class.

# Send SSH traffic to the high-priority class
sudo tc filter add dev eth0 protocol ip parent 1: prio 1 u32 \
  match ip protocol 6 0xff \
  match ip dport 22 0xffff flowid 1:10

# Send HTTP/HTTPS traffic to the normal class
sudo tc filter add dev eth0 protocol ip parent 1: prio 2 u32 \
  match ip dport 80 0xffff flowid 1:20

The match ip protocol 6 0xff expression matches the TCP protocol, and the match ip dport 22 0xffff expression matches the destination port . The flowid 1:10 sends the matching packets to class 1:10. The prio parameter determines the order in which the filters are evaluated.

b. Configuring policing on ingress

The ingress qdisc is a special qdisc that is attached to the interface for inbound traffic. It has no queue, and it is used as the parent for the filters that attach the police action.

# Add the ingress qdisc
sudo tc qdisc add dev eth0 handle ffff: ingress

# Police inbound traffic to 10 Mbps
sudo tc filter add dev eth0 parent ffff: \
  protocol ip \
  prio 1 \
  u32 match ip src 0.0.0.0/0 \
  police rate 10mbit burst 100kb drop

The handle ffff: ingress attaches the ingress qdisc with the handle ffff:, which is the standard handle for the ingress qdisc . The parent ffff: on the filter attaches the filter to the ingress qdisc. The u32 match ip src 0.0.0.0/0 matches every packet, and the police rate 10mbit burst 100kb drop drops the packets that exceed the rate . The tc -s filter show dev eth0 parent ffff: command shows the statistics, including the packets that were dropped.

The police action can also mark the packets instead of dropping them, which allows the downstream rules to handle them differently.

# Mark the packets that exceed the rate instead of dropping them
sudo tc filter add dev eth0 parent ffff: protocol ip prio 1 \
  u32 match ip src 0.0.0.0/0 \
  action police rate 5mbit burst 50kb conform-exceed pipe/ok \
  action skbedit mark 0x1

The conform-exceed pipe/ok option tells the policer to pass the conforming packets and to pass the exceeding packets to the next action . The next action is skbedit mark 0x1, which sets the firewall mark on the exceeding packets. The marked packets can be handled by the iptables rules or by the traffic control filters that match on the mark.

The police action can also be attached to an egress qdisc, which is useful when the ingress traffic needs to be shaped rather than policed. The ifb device is used for this purpose.

# Load the IFB module and create the device
sudo modprobe ifb
sudo ip link add ifb0 type ifb
sudo ip link set ifb0 up

# Redirect the ingress traffic to the IFB device
sudo tc qdisc add dev eth0 ingress
sudo tc filter add dev eth0 parent ffff: protocol ip u32 \
  match u32 0 0 action mirred egress redirect dev ifb0

# Shape the traffic on the IFB device
sudo tc qdisc add dev ifb0 root tbf rate 10mbit burst 64k latency 400ms

The mirred egress redirect action sends the ingress packets to the ifb0 device, where they are treated as egress traffic and shaped by the tbf qdisc . This is the correct approach for TCP traffic that should be shaped rather than policed, because the shaping buffers the excess packets and triggers the sender’s congestion control without the retransmissions that the policer causes.

c. The statistics and the tuning

The tc -s command shows the statistics for the qdiscs and the filters, which is the mechanism for confirming that the shaping or policing is working.

# Show the qdisc statistics
tc -s qdisc show dev eth0

# Show the filter statistics
tc -s filter show dev eth0 parent ffff:

The qdisc statistics show the packets and bytes that were transmitted, dropped, and overlimits. The overlimits counter is the number of times the qdisc was unable to send a packet because the rate was exceeded, which is the indicator that the shaping is active . The filter statistics show the packets that were matched and the packets that were dropped by the police action.

The burst parameter is the most important tuning knob. A burst that is too small produces excessive throttling or dropping, and a burst that is too large allows the traffic to exceed the rate for longer than intended. The tc-tbf man page notes that a 10 Mbit/s shaper needs at least about 10 KB of buffer, and the example in the validation summary uses burst 16kb to ensure that the configured rate can be sustained . The burst value should be at least the bandwidth-delay product of the link, or the shaper will underutilize the link.

Complete Example Session

# ============================================
# PART 1: SHOW THE CURRENT QDISC
# ============================================
tc qdisc show dev eth0
# Output shows the default qdisc (usually pfifo_fast)

# ============================================
# PART 2: ADD A TBF SHAPER
# ============================================
sudo tc qdisc add dev eth0 root tbf rate 10mbit burst 32kb latency 400ms

# ============================================
# PART 3: VERIFY THE SHAPER
# ============================================
tc qdisc show dev eth0
# Output shows tbf as the root qdisc

# ============================================
# PART 4: CHECK THE STATISTICS
# ============================================
tc -s qdisc show dev eth0
# Output shows the overlimits counter

# ============================================
# PART 5: ADD THE INGRESS QDISC
# ============================================
sudo tc qdisc add dev eth0 handle ffff: ingress

# ============================================
# PART 6: ADD THE POLICE FILTER
# ============================================
sudo tc filter add dev eth0 parent ffff: protocol ip prio 1 \
  u32 match ip src 0.0.0.0/0 \
  police rate 10mbit burst 100kb drop

# ============================================
# PART 7: VERIFY THE POLICE FILTER
# ============================================
tc filter show dev eth0 parent ffff:
# Output shows the filter with the police action

# ============================================
# PART 8: CHECK THE POLICE STATISTICS
# ============================================
tc -s filter show dev eth0 parent ffff:
# Output shows the packets dropped by the policer

# ============================================
# PART 9: CLEAN UP
# ============================================
sudo tc qdisc del dev eth0 root
sudo tc qdisc del dev eth0 ingress

The nine parts demonstrate the shaping and policing configuration: the initial state, the TBF shaper, the verification, the statistics, the ingress qdisc, the police filter, the filter verification, the police statistics, and the cleanup. The critical distinction is between Parts 2 and 6: the TBF is attached to the root egress qdisc and buffers the packets, while the police action is attached to the ingress filter and drops the packets.

Quick Reference

Shaping and Policing Comparison

Feature	Shaping (tbf)	Policing (police)
Direction	Egress	Ingress (or egress)
Mechanism	Delay (buffer)	Drop or mark
Effect on sender	Rate adaptation	Packet loss
Burst parameter	Token bucket size	Allowed burst
Statistics	`overlimits`	`dropped`

tbf Parameters

Parameter	Purpose	Example
`rate`	Maximum rate	`rate 10mbit`
`burst`	Token bucket size	`burst 32kb`
`latency`	Maximum queue delay	`latency 400ms`
`limit`	Maximum queue bytes	`limit 100kb`

police Options

Option	Purpose	Example
`rate`	Maximum rate	`rate 10mbit`
`burst`	Allowed burst	`burst 100kb`
`drop`	Drop exceeding packets	`drop`
`conform-exceed`	Action on conform/exceed	`pipe/ok`

Commands

Command	Purpose
`tc qdisc add dev eth0 root tbf ...`	Add a shaper
`tc qdisc add dev eth0 handle ffff: ingress`	Add the ingress qdisc
`tc filter add dev eth0 parent ffff: ... police ...`	Add a policer
`tc -s qdisc show dev eth0`	Show qdisc statistics
`tc -s filter show dev eth0 parent ffff:`	Show filter statistics

Best Practices

✅ Do This:

# Use tbf for egress shaping
tc qdisc add dev eth0 root tbf rate 10mbit burst 32kb latency 400ms # ✅

# Use police for ingress policing
tc filter add dev eth0 parent ffff: u32 match ip src 0.0.0.0/0 police rate 10mbit burst 100kb drop # ✅

# Use ifb for ingress shaping
tc filter add dev eth0 parent ffff: u32 match u32 0 0 action mirred egress redirect dev ifb0 # ✅

# Check the overlimits counter
tc -s qdisc show dev eth0                                      # ✅

# Tune the burst to the bandwidth-delay product
burst 32kb                                                     # ✅

❌ Don’t Do This:

# Try to shape ingress with a root qdisc
tc qdisc add dev eth0 root tbf ...    # Egress only            # ❌

# Use police for TCP traffic that should be shaped
# The retransmissions increase latency and waste bandwidth   # ❌

# Set burst too small
burst 1kb    # Excessive throttling or dropping              # ❌

# Forget the ingress qdisc
tc filter add dev eth0 parent ffff: ...    # No parent       # ❌

# Use the wrong handle for the ingress qdisc
tc qdisc add dev eth0 handle 1: ingress    # The standard is ffff: # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Shaping has no effect on ingress	Qdisc is egress-only	Use ingress policing or IFB
Excessive dropping	Burst too small	Increase `burst`
TCP performance degrades	Used policing instead of shaping	Use IFB redirection
Police filter not matching	Wrong parent or match	Verify the filter with `tc filter show`
Statistics show no traffic	Qdisc not attached to the right interface	Check the `dev` parameter

Real-World Examples

1. TBF shaper

tc qdisc add dev eth0 root tbf rate 10mbit burst 32kb latency 400ms

2. Ingress qdisc

tc qdisc add dev eth0 handle ffff: ingress

3. Police filter

tc filter add dev eth0 parent ffff: u32 match ip src 0.0.0.0/0 police rate 10mbit burst 100kb drop

4. Police with mark

tc filter add dev eth0 parent ffff: u32 match ip src 0.0.0.0/0 action police rate 5mbit burst 50kb conform-exceed pipe/ok action skbedit mark 0x1

5. IFB redirection

tc filter add dev eth0 parent ffff: u32 match u32 0 0 action mirred egress redirect dev ifb0

6. IFB shaper

tc qdisc add dev ifb0 root tbf rate 10mbit burst 64k latency 400ms

7. Show qdisc statistics

tc -s qdisc show dev eth0

8. Show filter statistics

tc -s filter show dev eth0 parent ffff:

9. HTB hierarchy

tc qdisc add dev eth0 root handle 1: htb default 30
tc class add dev eth0 parent 1: classid 1:10 htb rate 10mbit ceil 10mbit

10. HTB filter

tc filter add dev eth0 protocol ip parent 1: u32 match ip dport 22 0xffff flowid 1:10

Visual

Shaping vs Policing

┌──────────────────────────────────────────────────────────────┐
│  SHAPING BUFFERS; POLICING DROPS                             │
│                                                              │
│  Shaping (tbf, egress):                                      │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Packet arrives → queue → token bucket → transmit       │  │
│  │ Excess packets wait in the queue                       │  │
│  │ The sender is slowed by the delayed ACKs               │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  Policing (ingress):                                         │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Packet arrives → meter → drop or pass                  │  │
│  │ Excess packets are dropped immediately                 │  │
│  │ The sender retransmits, which reduces the rate         │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

The tbf Token Bucket

┌──────────────────────────────────────────────────────────────┐
│  TOKENS FILL AT THE CONFIGURED RATE                          │
│                                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Token bucket (burst size)                              │  │
│  │                                                        │  │
│  │ Tokens arrive at rate 10mbit                           │  │
│  │ Packet consumes tokens equal to its size               │  │
│  │ If tokens are available → transmit                     │  │
│  │ If not → queue until tokens arrive                     │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  The burst parameter is the bucket size.                     │
│  A larger bucket allows a longer burst at full speed.        │
└──────────────────────────────────────────────────────────────┘

Ingress Policing with IFB Shaping

┌──────────────────────────────────────────────────────────────┐
│  IFB ALLOWS INGRESS SHAPING                                  │
│                                                              │
│  eth0 (ingress)                                              │
│       │                                                      │
│       ▼                                                      │
│  ingress qdisc → filter → mirred redirect → ifb0             │
│       │                                                      │
│       ▼                                                      │
│  ifb0 (egress) → tbf qdisc → shape → transmit                │
│                                                              │
│  The ingress traffic is redirected to the IFB device,        │
│  where it is treated as egress and shaped.                   │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Shaping qdisc	`tbf` (Token Bucket Filter)
Shaping direction	Egress
Shaping mechanism	Buffer and delay
Policing action	`police`
Policing direction	Ingress (or egress)
Policing mechanism	Drop or mark
Ingress qdisc handle	`ffff:`
IFB for ingress shaping	`mirred egress redirect`
Burst tuning	At least the bandwidth-delay product
Statistics	`tc -s qdisc show`, `tc -s filter show`

Key takeaways:

Shaping buffers, and policing drops. The tbf qdisc holds the excess packets in a queue and releases them at the configured rate, while the police action drops or marks the packets that exceed the rate . The choice depends on whether the goal is to slow the traffic down or to enforce a hard limit.
Shaping is egress-only. The kernel can only delay the packets that it sends. The ingress qdisc is a placeholder for the filters that attach the police action, and it has no queue of its own .
The burst parameter is the most important tuning knob. A burst that is too small produces excessive throttling or dropping, and a burst that is too large allows the traffic to exceed the rate for longer than intended. The burst should be at least the bandwidth-delay product of the link .
The tbf qdisc is a pure shaper. It never schedules traffic; it throttles itself to ensure the configured rate is not exceeded. The htb qdisc is the hierarchical shaper that allows multiple classes with guaranteed rates and ceilings .
The police action can mark instead of drop. The conform-exceed pipe/ok option passes the exceeding packets to the next action, which can set a firewall mark for the downstream rules to handle .
IFB allows ingress shaping. The mirred egress redirect action sends the ingress packets to an IFB device, where they are treated as egress and shaped by a tbf qdisc. This is the correct approach for TCP traffic that should be shaped rather than policed .

Remember: Shaping and policing are the two operations of traffic control. Shaping delays the packets to enforce a rate, and policing drops or marks the packets that exceed a rate. The tbf qdisc is the pure shaper, and the police action is the policer. Shaping happens on egress, and policing happens on ingress. The burst parameter determines how much traffic can exceed the rate before the operation takes effect. The statistics show the overlimits for shaping and the drops for policing. The result is a network that can enforce bandwidth limits, prioritize critical traffic, and keep latency low under load.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!