2.2 QoS Policy: Queuing, Shaping, Policing & Interpreting MQC Output
Key Takeaways
- Queuing is an egress-only action because a queue can only form where packets contend for a transmit ring; policing and marking can run on ingress or egress.
- Low Latency Queuing is CBWFQ plus a strict-priority queue that is implicitly policed, so priority traffic exceeding its configured rate is dropped rather than allowed to starve every other class during congestion.
- Policing enforces a rate by dropping or re-marking excess and preserves the original traffic burstiness, while shaping enforces a rate by buffering excess into a delay queue, smoothing the flow at the cost of added latency.
- The shaping interval Tc equals Bc divided by CIR, and Cisco IOS-XE targets a default Tc of 4 milliseconds for 'shape average', so specifying only a CIR makes the router derive Bc as CIR divided by 250.
- Hierarchical QoS solves the sub-line-rate WAN problem: a parent policy shapes the aggregate to the carrier's contracted rate and a nested child policy performs LLQ and CBWFQ inside that artificial congestion point.
2.2 QoS Policy: Queuing, Shaping, Policing & Interpreting MQC Output
Section 2.1 established how a packet is classified and marked. This section covers what the network then does with that classification, which is where ENCOR v1.2 topic 1.4 ("Interpret QoS configurations") does most of its work. Every mechanism below is one of exactly two families:
- Congestion management — deciding the order in which queued packets are transmitted. Runs during congestion.
- Congestion avoidance — deciding which packets to discard before the queue fills, so that congestion never becomes total.
Plus two rate-enforcement mechanisms, policing and shaping, that create or prevent congestion rather than managing it.
1. Why Queuing Is Egress-Only
A queue forms where packets contend for a scarce resource. On a router or switch the scarce resource is the transmit ring of an egress interface. On ingress, packets are pulled off the wire as fast as the wire delivers them — there is nothing to schedule. Therefore:
| Action | Ingress | Egress |
|---|---|---|
| Classification | Yes | Yes |
Marking (set) | Yes | Yes |
Policing (police) | Yes | Yes |
Shaping (shape) | No | Yes |
Queuing (bandwidth, priority) | No | Yes |
WRED (random-detect) | No | Yes |
This table answers a large fraction of interpretation questions on its own. If a stem shows service-policy input on a policy containing priority percent 10, the configuration is invalid — you cannot queue on ingress.
2. Congestion Management: FIFO to LLQ
| Mechanism | Behaviour | Weakness |
|---|---|---|
| FIFO | Single queue, first in first out | One aggressive flow starves everything |
| WFQ | Automatic per-flow queues weighted by IP Precedence | No administrative control over which flow matters |
| CBWFQ | Administrator-defined classes, each with a bandwidth guarantee | Guarantees throughput but not latency |
| LLQ | CBWFQ plus a strict-priority queue that is serviced first | Priority queue can starve others, so it is policed |
CBWFQ: a guarantee, not a cap
bandwidth percent 30 reserves at least 30 percent of the interface rate for that class during congestion. When other classes are idle the class may exceed 30 percent — the reservation is a floor, not a ceiling. Only a police or shape statement imposes a ceiling.
Three mutually exclusive ways to express the guarantee:
bandwidth <kbps>— an absolute reservation.bandwidth percent <n>— a percentage of the interface (or of the parent shaper in HQoS).bandwidth remaining percent <n>— a share of whatever is left after the priority queue is served. This is the form you should expect alongside LLQ, and mixingbandwidth percentwithbandwidth remaining percentin the same policy-map is rejected.
By default IOS reserves 25 percent of the interface for control and Layer 2 overhead, so the sum of explicit bandwidth reservations is capped at 75 percent unless max-reserved-bandwidth is raised.
LLQ: strict priority with an implicit policer
policy-map WAN-EGRESS
class VOICE-BEARER
priority percent 10 <-- strict priority AND an implicit policer at 10%
class CALL-SIGNALLING
bandwidth remaining percent 5
class MULTIMEDIA-CONF
bandwidth remaining percent 30
random-detect dscp-based
class class-default
fair-queue
random-detect
The crucial and heavily tested property: the priority command is implicitly policed. During congestion, traffic in the priority class that exceeds the configured rate is dropped, not merely delayed. This is deliberate — without it, a flood of EF-marked traffic would starve every other class and turn a low-latency queue into a denial-of-service vector. When there is no congestion, the priority class may exceed its rate freely, because the implicit policer only engages when the interface is congested.
Design consequence: size the priority queue for the real call volume. Cisco's long-standing design guidance is to keep total LLQ allocation at or below roughly one third of link capacity; beyond that, the non-priority classes degrade badly.
3. Congestion Avoidance: Tail Drop vs. WRED
When a queue is completely full, the interface discards every new arrival. That is tail drop, and its pathology is global TCP synchronisation: every TCP flow loses packets in the same instant, every sender halves its window simultaneously, link utilisation collapses, then all senders ramp together and refill the queue. The link oscillates between starved and saturated.
Weighted Random Early Detection (WRED) breaks the synchronisation by dropping probabilistically and early, before the queue is full, so different flows back off at different times.
| Parameter | Meaning |
|---|---|
| Minimum threshold | Queue depth below which nothing is dropped |
| Maximum threshold | Queue depth above which everything is dropped (tail drop resumes) |
| Mark probability denominator (MPD) | At max threshold, 1 packet in MPD is dropped; default 10 |
random-detect dscp-based gives each DSCP its own threshold set, which is exactly what the AF drop-precedence design was built for: within AF3, AF33 (30) is configured with a lower minimum threshold than AF31 (26), so AF33 traffic starts being discarded first and AF31 survives longest.
WRED is for TCP, not UDP. Voice is UDP and does not respond to loss by slowing down, so applying WRED to an EF class simply damages calls without relieving congestion. You will never see random-detect inside a priority class in a correct configuration.
4. Policing vs. Shaping
Both enforce a rate. They differ entirely in what they do with the excess.
POLICING SHAPING
in ---> [ token bucket ] ---> out in ---> [ token bucket ]
| |
conform: transmit conform: transmit
exceed: re-mark or drop exceed: BUFFER, send later
violate: drop
Rate profile out of a policer: Rate profile out of a shaper:
|‾| |‾| |‾| (bursty, |‾‾‾‾‾‾‾‾‾‾‾‾‾‾| (smooth,
| |__| |______| | peaks clipped) | | peaks delayed)
| Property | Policing | Shaping |
|---|---|---|
| Excess handling | Drop or re-mark | Buffer and delay |
| Adds latency/jitter | No | Yes |
| Needs buffer memory | No | Yes |
| Direction | Ingress or egress | Egress only |
| Output profile | Bursty | Smoothed |
| TCP behaviour | Causes retransmissions | Avoids most retransmissions |
| Typical use | Enforce a customer contract; protect the control plane (CoPP) | Match a carrier's sub-line-rate CIR |
Token bucket mathematics
A policer holds a bucket of Bc bytes (the committed burst) that refills at CIR bits per second. A packet is conforming if enough tokens are present.
- Single-rate two-colour — conform or exceed.
- Single-rate three-colour (srTCM) — adds an excess burst bucket Be, giving conform / exceed / violate.
- Two-rate three-colour (trTCM) — adds a Peak Information Rate (PIR), so conform is below CIR, exceed is between CIR and PIR, and violate is above PIR.
A very common enterprise pattern re-marks rather than drops:
policy-map ISP-HANDOFF
class BULK-DATA
police cir 20000000 bc 625000 be 1250000
conform-action transmit
exceed-action set-dscp-transmit af12 <-- higher drop precedence, still delivered
violate-action drop
This is the AF drop-precedence system doing exactly what it was designed for: AF11 traffic that exceeds contract is demoted to AF12 so that downstream WRED discards it preferentially, instead of being destroyed at the edge.
Shaping and the Tc interval
A shaper does not transmit continuously at CIR; it transmits at line rate for part of each interval and then pauses. The interval is Tc, and the relationship is fixed:
Tc = Bc / CIR
Cisco IOS-XE targets a default Tc of 4 ms for shape average, which means that when you configure only a CIR the router derives Bc = CIR / 250 (because 4 ms is one 250th of a second). Worked example: shape average 10000000 on a 10 Mbps contract yields Bc = 10,000,000 / 250 = 40,000 bits per interval, transmitted 250 times per second.
Why 4 ms matters for voice: a shaper is silent for the remainder of each Tc. A long Tc (the legacy Frame Relay default was 125 ms) inserts up to 125 ms of jitter into a voice stream. A 4 ms Tc keeps shaping-induced jitter comfortably inside the 30 ms budget from Section 2.1. If an exam stem describes voice jitter appearing only after a shaper was configured, the Tc interval is the answer.
5. Hierarchical QoS: The Sub-Line-Rate Problem
A branch router has a GigabitEthernet handoff to the carrier, but the contract is 50 Mbps. The router's interface never sees congestion — it happily transmits at 1 Gbps — so no queuing policy ever engages. The carrier silently polices the excess away, and because the carrier's policer has no idea which packets are voice, it drops EF and scavenger with equal enthusiasm.
The fix is Hierarchical QoS (HQoS): create artificial congestion at the contracted rate, then queue inside it.
! CHILD - decides ordering within the shaped rate
policy-map CHILD-QUEUING
class VOICE-BEARER
priority percent 10
class CALL-SIGNALLING
bandwidth remaining percent 5
class MULTIMEDIA-CONF
bandwidth remaining percent 30
random-detect dscp-based
class class-default
fair-queue
!
! PARENT - creates the congestion point at the contracted CIR
policy-map PARENT-SHAPER
class class-default
shape average 50000000
service-policy CHILD-QUEUING <-- nested
!
interface GigabitEthernet0/0/0
description 50 Mbps carrier Ethernet handoff on a 1 Gbps port
service-policy output PARENT-SHAPER
Inside the child policy, priority percent 10 and bandwidth remaining percent are calculated against the parent's 50 Mbps shaped rate, not against the 1 Gbps physical interface. That is the entire point, and it is the most frequently misread detail in an HQoS configuration.
6. Interpreting show policy-map interface
Reading the counters is the literal exam skill. The output separates why packets were discarded.
Router# show policy-map interface GigabitEthernet0/0/0
GigabitEthernet0/0/0
Service-policy output: PARENT-SHAPER
Class-map: class-default (match-any)
48291043 packets, 39218473921 bytes
Queueing
queue limit 416 packets
(queue depth/total drops/no-buffer drops) 12/90114/0
shape (average) cir 50000000, bc 200000, be 200000
target shape rate 50000000
Service-policy : CHILD-QUEUING
Class-map: VOICE-BEARER (match-any)
3841022 packets, 737476224 bytes
Priority: 10% (5000 kbps), burst bytes 125000
Priority Level: 1
(total drops/bytes drops) 4127/792384
Class-map: MULTIMEDIA-CONF (match-any)
9922184 packets, 12894839200 bytes
bandwidth remaining 30%
(queue depth/total drops/no-buffer drops) 61/38221/0
Exp-weight-constant: 9 (1/512)
Mean queue depth: 58 packets
How to read it:
target shape rate 50000000confirms the parent is shaping to 50 Mbps, so the child percentages are relative to 50 Mbps.priority 10%therefore equals 5000 kbps, and the output states this explicitly.- Drops in
VOICE-BEARERare the implicit LLQ policer firing. 4127 drops means offered voice load has exceeded 5 Mbps during congestion — the priority allocation is undersized, or non-voice traffic is being misclassified into EF. - Drops in
MULTIMEDIA-CONFalongside a non-zeroMean queue depthare WRED discards, which is WRED working as intended. no-buffer dropsis a different failure entirely: the interface ran out of packet memory. That is a platform sizing problem, not a policy problem.- A class with zero packets means the classification never matched. Check the
class-mapbefore touching the queuing parameters — a policy that never matches is a classification bug wearing a queuing costume.
A branch router has a 1 Gbps physical handoff to the service provider but the purchased circuit is 50 Mbps. An engineer applies an egress policy containing LLQ for voice and CBWFQ for data directly to the GigabitEthernet interface. Voice quality remains poor and the provider reports heavy discards. Why is the policy ineffective, and what corrects it?
A policy-map contains 'class VOICE' with 'priority percent 15' applied outbound on a congested WAN link. During a period of unusually heavy call volume the offered voice load reaches 22 percent of link capacity. What happens to the voice traffic in excess of 15 percent?
An engineer configures 'shape average 8000000' under class-default on an egress policy and specifies no Bc value. Assuming the Cisco IOS-XE default shaping interval, what committed burst size does the router derive, and how many shaping intervals occur per second?
A service provider hands off a 100 Mbps Ethernet circuit and requires that customer traffic exceeding the contracted rate must still be delivered when capacity permits, but must be discarded ahead of conforming traffic during downstream congestion. Which policer action pairing implements this requirement?