Fair-Use and Bandwidth Management Policies: Traffic Shaping and Queuing

In any telecommunications network, total aggregated subscriber demand will periodically exceed physical uplink capacity during peak evening hours. If an Internet Service Provider treats all packets with indiscriminate First-In, First-Out (FIFO) tail-drop queuing, high-volume bulk downloads will monopolize interface buffers. This results in bufferbloat, soaring latency, and dropped packets for interactive real-time applications such as DNS lookups, video conferences, and gaming [1, 3].

To ensure equitable distribution of network resources, network operators establish structured Fair Usage Policies (FUP) supported by mathematical traffic shaping and active queue management [2, 3]. In this technical guide, we analyze the mechanics of bandwidth management, evaluate rate-limiting versus shaping, and examine DiffServ and modern FQ-CoDel scheduling algorithms [1, 3].

1. What is a Fair Usage Policy (FUP)?

A Fair Usage Policy (FUP) is a structured operational and commercial framework designed to prevent a tiny minority of ultra-heavy bandwidth consumers from degrading service quality for the broader subscriber base.

In typical unconstrained networks, statistical analysis frequently reveals a Pareto distribution: roughly 5% of heavy peer-to-peer or continuous data-transfer subscribers consume upwards of 40% of aggregate network capacity. During peak congestion windows, an effective FUP dynamically regulates bandwidth consumption:

• Subscribers receive full committed line rates for standard bursty interactive web and streaming activities.
• Accounts that exceed defined multi-gigabyte thresholds during peak hours undergo automated, graceful rate demotions until the congestion window clears.
• Critical infrastructure traffic (DNS, VoIP, NTP) maintains protected prioritization regardless of volume thresholds [1].

2. Traffic Policing vs Traffic Shaping

Network rate enforcement operates on two fundamentally distinct physical mechanisms: policing and shaping.

Traffic Policing (Rate Limiting)

Traffic policing enforces a hard bandwidth ceiling. When ingress traffic exceeds the configured rate limit, the router immediately drops excess packets [2].

• Advantages: Minimal memory and CPU consumption; introduces zero latency buffering.
• Disadvantages: Indiscriminate packet dropping severely impacts TCP performance. Dropped packets force TCP to enter fast recovery or retransmission timeout (RTO), causing throughput to plummet and fluctuate erratically. Policing should generally be reserved for ingress DDoS throttling rather than subscriber shaping.

Traffic Shaping (Rate Smoothing)

Traffic shaping buffers excess packets in memory queues, releasing them onto the transmission medium at a controlled, uniform rate [2].

• Advantages: Eliminates packet drops for transient traffic bursts; preserves smooth TCP window expansion.
• Disadvantages: Consumes router RAM for packet buffering; introduces delay if buffers become excessively deep.

3. The Token Bucket Algorithm

The mathematical foundation of commercial traffic shaping is the Token Bucket Algorithm, standardized in RFC 2697 [2].

Operational Mechanics

Imagine an abstract bucket with a predefined maximum token capacity, known as the Burst Size ($B$):

1. Tokens are continuously deposited into the bucket at a constant, uniform rate corresponding to the Committed Information Rate ($CIR$).
2. When a packet containing $L$ bytes arrives at the interface:
   • If the bucket contains at least $L$ tokens, the packet transmits immediately, and $L$ tokens are removed from the bucket.
   • If fewer than $L$ tokens are present (the bucket is empty), the packet must wait in the buffer queue until sufficient tokens accumulate (shaping) or be discarded (policing) [2].
3. If the link is idle, tokens accumulate up to the maximum capacity $B$, allowing the subscriber to burst above the CIR for a brief initial fraction of a second when initiating a new web page load [2].

4. Differentiated Services (DiffServ) and Traffic Classification

Bandwidth management is ineffective without protocol classification. In accordance with RFC 2474, routers classify packets by inspecting and setting the Differentiated Services Code Point (DSCP) field in the IP header [1].

The 6-bit DSCP field provides 64 distinct priority markings:

• Default Forwarding (DF / Best Effort - DSCP 0): Standard web browsing, file downloads, and bulk traffic.
• Expedited Forwarding (EF - DSCP 46): Dedicated strictly to ultra-low-latency, mission-critical traffic such as VoIP RTP voice streams. Packets marked EF receive strict priority queuing, bypassing standard buffers entirely [1].
• Assured Forwarding (AF classes): Divided into four classes and three drop-precedence levels (e.g., AF41 for interactive video, AF13 for background backups).

At the network edge, the ISP's Border Network Gateway (BNG) or core router inspects traffic and maps it to appropriate queuing classes.

5. Mitigating Bufferbloat with FQ-CoDel

Historically, routers relied on simple FIFO queues paired with massive memory buffers. When a link saturated, large buffers filled completely, introducing hundreds of milliseconds of artificial queuing delay (bufferbloat).

To solve bufferbloat, the IETF ratified RFC 8290: Flow Queue Controlled Delay (FQ-CoDel) [3].

How FQ-CoDel Transforms Bandwidth Management

FQ-CoDel is a modern hybrid scheduler that combines flow isolation with active queue management:

1. Flow Hashing (Deficit Round Robin): Ingress packets are hashed into hundreds of separate internal sub-queues based on their 5-tuple flow keys. High-volume bulk downloads (e.g., a multi-gigabyte OS update) cannot clog the sub-queue used by a lightweight DNS lookup or SSH keystroke.
2. Controlled Delay (CoDel): Rather than measuring queue depth in bytes, CoDel measures how long packets sit in the queue (the sojourn time). If sojourn time exceeds a target threshold (typically 5 ms) over a rolling 100 ms interval, CoDel initiates proactive packet dropping or Explicit Congestion Notification (ECN) marking [3].
3. TCP Backoff Signaling: By dropping or marking an occasional packet early, CoDel signals the sender's TCP congestion algorithm to gently reduce its transmission rate before the buffer overflows, maintaining pristine latency even under 99% link saturation [3].

Comparison of Bandwidth Management Disciplines

Best Practices for ISP Network Administrators

1. Implement Hierarchical Token Buckets (HTB): Structure shaping policies hierarchically: cap individual subscriber lines while dynamically allocating unused bandwidth from higher-level parent queues when the overall network is uncongested.
2. Prioritize Control Plane and DNS: Always assign Expedited Forwarding (EF) or dedicated high-priority queues to DNS, DHCP, ARP, and routing protocol handshakes. Fast DNS resolution makes the entire network feel significantly faster to users.
3. Deploy FQ-CoDel on Last-Mile Gateways: Enforce FQ-CoDel or CAKE on subscriber aggregation nodes to eliminate bufferbloat and guarantee responsive gaming and voice performance during peak downloads [3].

Designing robust, high-capacity traffic management policies requires rigorous network modeling. Learn how our team supports internet operators on our NOC & Network Operations Support page.

Key Takeaways

• Bandwidth management prevents a small minority of bulk data transfers from saturating uplinks during peak hours.
• Traffic policing drops excess packets, while traffic shaping smooths traffic by buffering frames in memory.
• The Token Bucket algorithm (RFC 2697) mathematically meters committed information rates and transient burst allowances.
• FQ-CoDel (RFC 8290) separates independent flows and eliminates bufferbloat by monitoring queue sojourn time.

Need help with this? Contact us.

Sources

[1] IETF, "RFC 2474: Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", 1998. URL: https://www.rfc-editor.org/rfc/rfc2474.html (Specifies the DSCP byte layout, traffic conditioning, and Per-Hop Behaviors in IP networks).

[2] IETF, "RFC 2697: A Single Rate Three Color Marker", 1999. URL: https://www.rfc-editor.org/rfc/rfc2697.html (Mathematical definition of token bucket metering for committed and peak burst traffic).

[3] IETF, "RFC 8290: The Flow Queue CoDel (FQ-CoDel) Packet Scheduler", 2018. URL: https://www.rfc-editor.org/rfc/rfc8290.html (Standard active queue management specification combining fair queuing with controlled delay packet dropping).

Last reviewed: October 2026