The value of Tc defines the time interval during which you send the Bc bits in order to maintain the average rate of the CIR in seconds.
Tc = Bc/CIR (in seconds)
Example using a CIR (or policer rate) of 8000 bps and a normal burst of 1000 bytes.
Router(config)# policy-map police-setting
Router(config-pmap)# class access-match
Router(config-pmap-c)# police 8000 1000 conform-action transmit exceed-action drop
The token buckets starts full at 1000 bytes. If a 450 byte packet arrives, the packet conforms because enough bytes are available in the token bucket.
The conform action (transmit) is taken by the packet and 450 bytes are removed from the token bucket (leaving 550 bytes).
If the next packet arrives .25 seconds later, 250 bytes are added to the token bucket as per the following formula:
(0.25 * 8000)/8
The calculation leaves 700 bytes in the token bucket.
If the next packet is 800 bytes, the packet exceeds and the exceed action (drop) is taken. No bytes are taken from the token bucket.
Both the shape and police commands restrict the output rate to a maximum kbps value. Importantly, neither mechanism provides a minimum bandwidth guarantee during periods of congestion.
Use the bandwidth or priority command to provide such guarantees.
Traffic Policing
Command
|
Purpose
|
|---|
Router(config-pmap-c)# police bps burst-normal burst-maxconform-action action exceed-action action violate-actionaction
|
Specifies a maximum bandwidth usage by a traffic class.
|
In this particular example, traffic policing is configured with the average rate at 8000 bits per second, the normal burst size at 2000 bytes, and the excess burst size at 4000 bytes. Packets coming into Fast Ethernet interface 0/0 are evaluated by the token bucket algorithm to analyze whether packets conform exceed, or violate the specified parameters. Packets that conform are transmitted, packets that exceed are assigned a QoS group value of 4 and are transmitted, and packets that violate are dropped.
Router(config)# class-map acgroup2Router(config-cmap)# match access-group 2Router(config-cmap)# exitRouter(config)# policy-map policeRouter(config-pmap)# class acgroup2Router(config-pmap-c)# police 8000 2000 4000 conform-action transmit exceed-action set-qos-transmit 4 violate-action dropRouter(config-pmap-c)# exitRouter(config-pmap)# exitRouter(config)# interface fastethernet 0/0Router(config-if)# service-policy input police
Token Bucket Algorithm with One Token Bucket
The one token bucket algorithm is used when the violate-action option is not specified in the police command CLI.
The conform bucket is initially set to the full size (the full size is the number of bytes specified as the normal burst size).
When a packet of size B bytes arrives at time t the following actions occur:
a. Tokens are updated in the conform bucket. If the previous arrival of the packet was at t1 and the current time is t, the bucket is updated with (t-t1) worth of bits based on the token arrival rate. The token arrival rate is calculated as follows:
(time between packets<which is equal to t-t1> * policer rate)/8 bytes
b. If the number of bytes in the conform bucket - B is greater than or equal to 0, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is completed for the packet.
c. If the number of bytes in the conform bucket - B is less than 0, the exceed action is taken.
Token Bucket Algorithm with Two Token Buckets
The two token bucket algorithm is used when the violate-action is specified in the police command CLI.
The conform bucket is initially full (the full size is the number of bytes specified as the normal burst size).
The exceed bucket is initially full (the full exceed bucket size is the number of bytes specified in the maximum burst size).
The tokens for both the conform and exceed token buckets are updated based on the token arrival rate (or CIR).
When a packet of size B bytes arrives at time t the following actions occur:
a. Tokens are updated in the conform bucket. If the previous arrival of the packet was at t1 and the current arrival of the packet is at t, the bucket is updated with t-t1 worth of bits based on the token arrival rate. The refill tokens are placed in the conform bucket. If the tokens overflow the conform bucket, the overflow tokens are placed in the exceed bucket.
The token arrival rate is calculated as follows:
(time between packets<which is equal to t-t1> * policer rate)/8 bytes
b. If the number of bytes in the conform bucket - B is greater than or equal to 0, the packet conforms and the conform action is taken on the packet. If the packet conforms, B bytes are removed from the conform bucket and the conform action is taken. The exceed bucket is unaffected in this scenario.
c. If the number of bytes in the conform bucket - B is less than 0, the excess token bucket is checked for bytes by the packet. If the number of bytes in the exceed bucket - B is greater than or equal to 0, the exceed action is taken and B bytes are removed from the exceed token bucket. No bytes are removed from the conform bucket.
d. If the number of bytes in the exceed bucket - B is less than 0, the packet violates and the violate action is taken. The action is complete for the packet.
Example: Router(config-pmap-c)# police 8000 1000 1000 conform-action transmit exceed-action set-qos-transmit 1 violate-action drop
