Traffic Shaping Explained: QoS, Policing and Buffering for Network+

Traffic shaping controls the rate at which traffic leaves an interface by buffering packets that exceed a configured rate and releasing them smoothly. It is one half of a pair, and the exam almost always tests it against the other half — policing.

Shaping versus policing

Both enforce a rate limit. They differ in what happens to the traffic that exceeds it.

Aspect	Shaping	Policing
Excess traffic	Buffered and sent later	Dropped or re-marked
Effect on delay	Adds latency and jitter	No added delay
Effect on loss	Avoids loss	Causes loss
Direction	Outbound	Inbound or outbound
Effect on TCP	Smooth, fewer retransmits	Retransmissions, sawtooth throughput

The rule of thumb: shaping delays, policing drops. Shape when you can afford latency but not loss — a file transfer over a metered WAN link. Police when you must not add delay, or when you are enforcing a hard ceiling on someone else's traffic at your network edge.

Shaping is outbound only, because you cannot buffer traffic that has already arrived. Policing can be applied in either direction, which is why an ISP polices your inbound traffic at their edge.

The token bucket

Both mechanisms are usually described with a token bucket, and the vocabulary appears in questions.

Tokens are added to a bucket at the committed information rate. Sending a packet consumes tokens. If tokens are available the packet goes immediately; if not, a shaper queues it until tokens accumulate, while a policer drops or re-marks it.

CIR, the committed information rate, is the guaranteed long-run average. Burst size is how large the bucket is — how much traffic can exceed the CIR momentarily because tokens accumulated while the link was quiet. Bursting is a feature, not a fault: it lets bursty applications feel fast without breaking the average.

Where quality of service fits

Shaping controls how much. QoS decides who goes first when the link is congested. In practice they work together.

Classification identifies traffic — by port, protocol, source, or deep inspection.

Marking tags it so downstream devices do not have to reclassify. DSCP uses six bits in the IP header at layer 3; CoS uses three bits in the 802.1Q VLAN tag at layer 2. Know which layer each belongs to — that is a reliable exam question.

Queuing decides service order. Priority queuing always serves the high-priority queue first, which is right for voice and wrong for everything if it starves other traffic. Weighted fair queuing shares bandwidth proportionally. Class-based weighted fair queuing combines both: a strict priority queue for voice, weighted shares for the rest.

Congestion avoidance drops selected packets before the queue is full, so TCP backs off gradually instead of every flow retransmitting at once.

What different traffic needs

The exam likes scenarios where you match treatment to application.

Voice needs low latency and very low jitter, and tolerates a little loss. Small packets, steady rate. Give it priority queuing, not more bandwidth.

Video conferencing needs low jitter and more bandwidth, and is bursty.

Streaming video buffers, so it tolerates latency and jitter but wants sustained throughput.

Bulk transfer and backups tolerate everything except being allowed to consume the whole link. This is the classic shaping candidate.

Interactive traffic such as SSH or remote desktop is small but latency sensitive.

If a scenario says calls break up when a backup runs, the answer is QoS prioritising voice, and shaping the backup traffic.

Bandwidth is not the answer

A point CompTIA makes repeatedly: adding bandwidth does not fix jitter or prioritisation. If a single backup job can still fill the pipe, a bigger pipe just means a bigger job filling it. Shaping and QoS manage contention; capacity alone does not.

Where it appears

Network+ (N10-009) covers shaping, policing, QoS marking and queuing under network optimisation.

Security+ (SY0-701) touches it through availability — rate limiting as a control against resource exhaustion and denial of service.

What to remember

Shaping buffers and delays; policing drops or re-marks. Shaping is outbound only; policing works in both directions. CIR is the committed rate, burst size is how far you may briefly exceed it. DSCP marks at layer 3, CoS at layer 2. Voice needs priority, not bandwidth. And more bandwidth does not solve a prioritisation problem.

Related reading: NetFlow and sFlow · SDN · WAN