So we're gonna call the issue with policing and why we have it.
The idea here is maybe we're a service provider and we have a router upstream
from a customer
and we want to make sure that we are limiting their bandwidth on this link.
Now this link, I've drawn it almost like it's a serial link here, but this
could just be
a straight up one gigabit per second ethernet handoff.
But the customer only paid for 600 megabits per second, something like that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But the customer only paid for 600 megabits per second, something like that.
Naturally I can't set an ethernet speed to anything other than what's
established as
a specified speed, like 1 gig, 2.5 gig, 100 meg, and 600 meg is just not one of
those
options.
So what I do is I establish a policeor.
This is built on my MQC policy.
I apply it to this interface and I limit it to 600 megabits per second.
But as we've said before, it's very difficult to just track data traffic flow WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But as we've said before, it's very difficult to just track data traffic flow
here and say
that, okay, this packet is in clear violation of 600 megabits per second.
And the reason is because this megabits per second is not a number that exists
at any
given time.
And we're talking about bits over seconds.
And so the question is, how many seconds are we talking about here?
If I look at your bits over the course of one millisecond, well, that means WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If I look at your bits over the course of one millisecond, well, that means
that it's
going to have a very different measurement than if I measure this out over
several seconds.
And so we want a fair way to evaluate whether or not you're abiding by the
policing policy.
And that leads us to the token bucket methodology.
So what we want to do here is explore how exactly we're going to take our token
bucket
method and translate it over to configuration.
So recall how exactly our token bucket system works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So recall how exactly our token bucket system works.
The idea here is that we want to limit you by your rate, but we also want to
understand
that there's not a super fair way of measuring this where we all agree on
exactly what, you
know, what that means.
Again, we all would maybe have different ideas of what average time we should
use here.
And so instead we're going to come up with something that does provide a firm
answer.
And so we're going to have a rate of tokens. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so we're going to have a rate of tokens.
We collect these tokens in what we call a bucket.
Naturally, this is just a bunch of bits inside of the rowdy router or switch
system.
It's not a physical bucket or anything like that, but it's just a tracking of
how many
packets were allowed to send.
And importantly, each one of these tokens is actually equal to one byte.
So yes, larger packets do require more tokens because if a token matched up to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So yes, larger packets do require more tokens because if a token matched up to
a packet,
then a smaller package would consume our tokens at the same rate as larger
packets and that
wouldn't make any sense.
We fill this token bucket at a particular rate.
This rate is known as the committed information rate or the CIR.
And this is an important term because we're going to use this as part of our
CLI configuration.
So again, that stands for the committed information rate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So again, that stands for the committed information rate.
And so when packets come through here, if we have a packet that wants to be
sent, and
let's say it's 600 bytes in size, well, I'm going to attempt to consume 600
tokens.
So if I have 600 tokens to consume, I will consume those.
I will say, all right, we are good to go.
And then this falls into that category of a conforming packet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then this falls into that category of a conforming packet.
Whereas if a packet comes through and it could be smaller than 600, it could be
400 bytes.
But maybe that 600 byte packet consumed all of our tokens.
And so we say, all right, well, we don't actually have 400 tokens.
And so we're going to categorize this as an exceeding packet.
Now the action here is up to us.
I can use actions as we've said, such as transmit or allow this packet to go
through.
I can drop the packet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I can drop the packet.
And so usually we have conforming as a transmit action, exceeding as a drop
action.
But we can actually remark the packet and transmit it as well.
So this is sort of a a punishment option to say, we're going to send this
packet, but
we're going to make it more likely that this packet gets dropped down the line.
And so we'll remark it and send it.
So we're going to send it for right now, but it might get dropped later.
That's usually what we're talking about with this.
And I will say with the standard token bucket system, where we have two stat WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I will say with the standard token bucket system, where we have two stat
uses, conform
and exceed, we're usually going to match those up to transmit and drop.
There's not a whole lot of situations where we would remark the exceeding
traffic, because
in that situation, we would not have the option to drop traffic, since we only
have two different
statuses.
Now here's a question for us.
Why have this bucket at all?
Why have the token bucket?
Why not just more or less, why not just say that, hey, this rate is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Why not just more or less, why not just say that, hey, this rate is going to
allow me to
send so many packets at once?
Well the reason for this is because we are going to have a size for our token
bucket,
and this size is going to be measured in bytes.
And so this provides a number of bytes that sort of like a buffer.
And this buffer is intended to allow us to burst by sending more traffic than
let's say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's say
the 600 megabits per second that we signed up to have here.
Since we can configure the size of the bucket, that means that if we have a
smaller bucket,
we allow for smaller bursts.
If we have larger bucket, we allow for greater bursts.
But naturally, if I'm filling this bucket, let's say at 600 megabits per second
, and
I'm sending packets here at about 600 megabits per second, I'm maxing it out,
well any amount
of bursting will deplete the bucket and as long as one token basically goes in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of bursting will deplete the bucket and as long as one token basically goes in
and then
immediately comes out, if that's the rate at which I'm sending packets, then
this bucket
isn't going to fill up anytime soon.
We really have to see a lull in traffic, basically we go down to like 400 or
300 megabits per
second for a while, and that'll allow the bucket to fill back up.
So kind of an interesting mechanism when we put it all together and see kind of
how it
all works here, but this is the basic set of mechanisms for the token bucket. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all works here, but this is the basic set of mechanisms for the token bucket.
We especially need to pay attention to a few things when it comes to our
configuration.
We have to pay attention to this CIR, the committed information rate.
We have to pay attention to the size of the token bucket.
We have a phrase for this, we call this the committed burst or BC, and we'll
see later
there's a BE as well, so we need to keep those straight, but BC for right now
is going to
be important.
We also are going to need to pay attention to the fact that this action is not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also are going to need to pay attention to the fact that this action is not
predefined.
We have to decide what action to take.
The token bucket system only gives us a status for a particular packet.
It gives up to us whether we're going to drop or remark those packets.
So when we look at the configuration at the CLI, we're going to perform this
configuration
under a policy map, and then under a class.
So whatever class this is, a lot of cases we're going to apply policing to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So whatever class this is, a lot of cases we're going to apply policing to the
default
class.
So this might be, for example, class default in our configurations.
But if we're policing individual tags at different rates, then we might see
police are supplied
to different classes than just the class default.
So keep that in mind as well.
But here we get into the syntax.
So the syntax is going to involve the word police.
That's what kicks us off here.
And typically we're going to specify the CIR right away. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And typically we're going to specify the CIR right away.
And then we apply that rate, whatever that rate is.
So maybe it's 80 kilobits per second.
Maybe it's 600 megabits per second.
But we're going to apply this as again, the CIR here in our token bucket
methodology.
From here, we are going to want to assign a BC.
So type BC in.
And then this is going to be the size of our bucket.
Now this is actually an optional configuration.
We could just hit enter here.
Now if we hit enter, might say, well, does that mean that there's no bucket? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now if we hit enter, might say, well, does that mean that there's no bucket?
Well, no, actually, there is a default size.
But this default size is actually not based on a size but based on a time.
It's based on 250 milliseconds of traffic based on this rate.
Kind of an interesting situation here.
So as an example here, let's just say that we enter a CIR of-- this is just to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as an example here, let's just say that we enter a CIR of-- this is just to
880 kilobits
per second, 80,000 bits per second.
So if I'm going to say how much the default BC is, if I just hit enter with
this CIR of
80 kilobits per second, how big is my token bucket?
Well, based on 250 milliseconds, we just do our math.
We say 80,000 bits per second times 250 milliseconds, so 0.250 seconds. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We say 80,000 bits per second times 250 milliseconds, so 0.250 seconds.
But then we also have to convert bits to bytes because, again, our size is in
bytes.
So we'd multiply by 8 bits per byte.
Little bit of high school math here, but essentially what we do is we could say
, OK,
well, 80,000 divided by 8, that's going to be 10,000.
And then I'm effectively dividing the 10,000 by 4.
So this would be 2,500 bytes. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this would be 2,500 bytes.
Somebody can check my math on that, but I believe that's correct.
So if I don't specify a BC, the size will be based on the 250 millisecond
default.
And there is a minimum value of 1,500 bytes, although this could vary by
platform.
So keep that in mind as well.
But if we have a really small CIR of like 8,000 bits per second, or 8 kilobits
per second,
that would be an extremely small BC. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that would be an extremely small BC.
And yeah, the system's not going to go that low.
It's going to go down to 1,500 bytes.
Now we're not quite done because we have this third thing that we have to pay
attention to.
We've got our CIR.
We've got our BC.
And so once I hit Enter, I do my police command again.
So something like CIR, whatever, BC, whatever.
I could actually keep going here.
The syntax is very flexible.
I could keep going and say conform action, exceed action.
And we'll see this when we're coming up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll see this when we're coming up.
But I can also just hit Enter here.
And by hitting Enter, now I enter into a police sub-configuration option, where
now I can type
out my conform action.
And so I could say conform action transmit.
And I can say exceed action in here as well.
So my exceed, exceed action could just simply be drop, which in this basic
token bucket
system, that's oftentimes what we are going to go with. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
system, that's oftentimes what we are going to go with.
So that's an idea of the system we're trying to build, as well as the
configuration it
maps to.
Let's go ahead and jump on the CLI and see what this looks like.