Traffic Policing Explained: Rate Limiting and Re-marking for Network+

Traffic policing enforces a rate limit by dropping or re-marking traffic that exceeds it. Nothing is buffered and nothing is delayed — traffic either conforms and passes, or it does not and is dealt with immediately.

It is the counterpart to traffic shaping, and the exam almost always tests the pair together. This article is about policing specifically.

Why drop rather than delay

Policing adds no latency, which is its defining advantage. A shaper holds excess traffic in a queue until tokens are available, and that wait is delay and jitter. A policer makes an immediate decision, so conforming traffic passes at line rate with no queuing.

That makes policing the right choice when delay is worse than loss, and when you are enforcing a limit on traffic you do not control.

The cost is that dropping hurts TCP. Loss triggers retransmission and congestion-window reduction, producing the familiar sawtooth where throughput climbs, hits the limit, collapses and climbs again. Aggressive policing of TCP traffic can deliver noticeably less usable throughput than the configured rate.

Where policing is applied

At the service provider edge. This is the common case. You buy a 100 Mbps service on a gigabit port, and the provider polices you to 100. Traffic above it is discarded before it enters their network.

On ingress generally. Policing works inbound as well as outbound, whereas shaping is outbound only — you cannot buffer what has already arrived. If a question specifies inbound rate limiting, the answer is policing.

Against abuse. Rate limiting a protocol or a source to blunt denial of service, control peer-to-peer traffic, or cap a guest network.

On the control plane. Control plane policing protects a device's CPU from being overwhelmed by management or routing traffic — a security control as much as a performance one.

How the decision is made

A policer uses a token bucket. Tokens arrive at the committed information rate; the bucket size is the committed burst. A packet that finds enough tokens conforms; one that does not, exceeds.

A single-rate two-colour policer gives two outcomes: conform and exceed. A single-rate three-colour policer adds an excess burst, producing green, yellow and red — conform, exceed and violate. A two-rate three-colour policer adds a peak information rate, so traffic between the committed and peak rates is marked yellow and only traffic above the peak is red.

Three actions are available: transmit, drop, or re-mark and transmit.

Re-marking

The subtlety worth understanding, because it is more useful than dropping.

Instead of discarding excess traffic, the policer lowers its DSCP value and forwards it. The traffic gets through when the network is quiet, and becomes the first to be discarded downstream if congestion occurs.

That gives a soft limit rather than a hard one: customers get burst capacity when it is free, and the network still protects itself under load. If a scenario asks how to allow bursting above the committed rate without guaranteeing it, re-marking is the answer.

Policing versus shaping

Aspect	Policing	Shaping
Excess traffic	Dropped or re-marked	Buffered and sent later
Latency added	None	Yes
Loss	Yes	Avoided
Direction	Inbound or outbound	Outbound only
Memory required	Minimal	Buffers
Typical position	Provider edge, ingress	Customer edge, egress

The usual pairing in practice: the customer shapes outbound to just under the contracted rate so that the provider's policer never has to drop anything. Shaping on your side is cheaper than losing packets on theirs.

Choosing between them

Police when latency must not increase, when you are limiting traffic you do not own, when enforcing a hard contractual ceiling, or when protecting a device from overload. Shape when loss is more damaging than delay, when smoothing bursty traffic to fit a slower link, and when you want to avoid triggering someone else's policer.

For voice traffic, neither is the primary answer — prioritisation is. Policing voice causes dropouts and shaping it causes jitter.

What to remember

Policing drops or re-marks; shaping buffers. Policing adds no delay but causes loss and TCP retransmission. It works in both directions, while shaping is outbound only. CIR is the committed rate, and three-colour policers add a peak rate and an excess burst. Re-marking gives soft limiting, letting traffic through when capacity allows.

Related reading: Traffic shaping and QoS · NetFlow and sFlow · DRDoS