We have a Cisco C2900 ISR here, with the following configured:

policy-map XX_4M _IN
 police rate 4000000 burst 400000
 conform-action transmit
 exceed-action drop

The policy-map is applied on an interface.

Can somebody explain how "burst" works exactly ? I cannot find any clear documentation about it.

If I have 4.3 Mbps of traffic coming in, what will happen ? Will 4 Mbits be forwarded, and the remaining 0.3 Mbits dropped ? Or will the Burst value make it possible to forward it all ? Can this be sustained over a longer period ?

If I had 20 Mbps of bandwidth available, and wanted to limit bandwidth to 10 Mbps on 1 port and 10 Mbps on another port, but allow one port to use all 20 Mbps when the other port does not use any bandwidth, could I do this with Policing or would I need Shaping, or something else ?

1 Answer 1


In some rate-limit devices, limiting is based on a pool of 'credits'; each packet decreases the pool by x credits and the pool of credits is replenished by y credits per second, up to a maximum value z.

A connection can use all of its credits as quickly as it likes, but packets will be dropped if there are no credits remaining in the pool.

In implementations without a max value, if the connection waits for a long period, it could (in theory) save up a massive pool of credits, and use them all at once, which effectively means it is not rate-limited. In implementations with a max value, the effect of a connection using all its saved credits at once is limited.

In devices that operate under those scenarios, x, y and z are calculated for you, based on the desired police rate and the burst value. The burst value directly affects the max value z.

In practical terms, this should mean that the first 400,000 bytes can go through the router at line rate, after which it is artifically limited to 4,000,000 bits per second. However, because the exact values of x, y and z are derived, there may be some fluctuation in the observed traffic.

(Note, the implementation I am describing is actually hashlimit in Linux's iptables, and I am inferring similar-enough semantics onto the Cisco ISR, based on the rate and burst terms. Cisco, themselves, may have a different algorithm -- I am happy to defer to a definitive Cisco guide. More details of hashlimit can be found here, if you are interested.)

Edit: Cisco documentation mostly seems to agree with me with regards to tokens and cost.

Edit #2: For the second part of your question, regarding splitting the bandwidth between two ports, is this to facilitate two LAN interfaces sharing one outside WAN internet connection? If so (and if your IOS supports it), I might start with something along the lines of:

class-map CLS_VLAN1
  match input-interface Ethernet1
class-map CLS_VLAN2
  match input-interface Ethernet2

policy-map PMAP_OUTSIDE
  class CLS_VLAN1
    bandwidth percent 50
  class CLS_VLAN2
    bandwidth percent 50

interface Ethernet0
  service-policy PMAP_OUTSIDE

...although I might be mixing my IOS and ASA command references a little (I haven't got an ISR in front of me to test on.)

Edit #3: I've also seen some reference suggesting that you bandwidth percent values shouldn't add up to more than 75, so you may never get an exact 50/50 split -- 35/35 might be the best you can do.

  • Would the bandwidth command really work here ? If I have "bandwidth 10000" configured on my Eth0 interface (outgoing), is it really going to be capable of sharing 50% to Eth port 1, and 50% to Eth port 2 ? Unfortunately I can't test either
    – user53632
    Commented Mar 15, 2019 at 16:59
  • @user53632 (1/2) - why do you think it wouldn't be capable? If the device is capable of pushing 20Mbps, then it is capable of sharing that between two inputs and already will without your alterations. bandwidth is a minimum amount allocated to each class, while police is a maximum amount. If you want a maximum of 10Mbps for Eth1, you class E1 police 10000, then Eth1 will not exceed that but Eth2 could; if you class E1 police 10000 and class E2 police 10000 neither could extend into the other allocation (except for a brief burst). Commented Mar 15, 2019 at 23:34
  • @user53632 (2/2) - for me the better option is to guarantee a minimum for both traffic classes (e.g. class E1 bandwidth 4000 / class E2 bandwidth 4000), and then let the device balance the remaining bandwidth as it already would. Then, from your 20Mbps, both Eth1 and Eth2 could use the full range of 0-20Mbps, but if one went ballistic, the other would still have some guaranteed service. I don't think you'll ever get a true 50/50 split. Commented Mar 15, 2019 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.