Demystifying Traffic Shaping: Improve Network Performance with Traffic Shaping

Have you ever used a network where some Internet-based applications performed more slowly than others? Companies that reduce (or altogether prohibit) the speed of torrent apps are a common example. It's known as traffic shaping. This is typically done to prevent users of that network from using such kinds of applications, sometimes during specific hours, as their use may impair the services provided to other network users.

In general, the following four elements have an impact on a network's quality: bandwidth, jitter, packet loss, and latency. These elements might not be a big deal in a network when all devices are close to one another and bandwidth is not an issue like in a local area network. In these networks, all you have to do is ensure your wired or wireless connections have adequate bandwidth to support the network traffic. Such networks are often built at a modest, one-time cost.

However, these network quality variables become important when we connect to distant networks that must be connected to one another such as a wide area network or when we connect to a public network like the Internet.

Traffic shaping switches, rules, and policies, also known as packet shaping, prioritize traffic and bandwidth to provide a superior quality of service, or QoS, for network traffic related to business. You may learn more about traffic shaping in this post and get the answers to these questions. Traffic shaping is a crucial activity that will be described in more detail below.

What is Traffic Shaping?​

On computer networks, the practice of "traffic shaping" involves delaying some or all datagrams in order to bring them into compliance with a desired traffic profile. Traffic shaping is used to enhance latency, increase available bandwidth, optimize or ensure performance for certain packet types while delaying others.

By regulating the quantity of data that enters and leaves the network, traffic shaping helps companies improve network performance. According to network policies, traffic is divided into categories, queued, and directed. In essence, traffic shaping controls the network by delaying the delivery of priority applications while speeding up the transmission of packets deemed less important.

Organizations can control the network's capacity to guarantee the functionality and level of service of their critical apps and commercial traffic.

By regulating burst size and using the leaky bucket method to smooth the output rate over at least eight-time intervals, traffic shaping aims to avoid delay, jitter, and loss. Traffic will continue to flow normally even if it arrives slower than the configured rate. Traffic will wait in a buffer until it can proceed without exceeding the limit if it arrives faster than the configured rate. Then, although less crucial packets continue to be queued, the highest priority packets are promptly delivered. When the buffer is full, traffic shaping occasionally simply discards any incoming packets.

The committed information rate, or CIR, for traffic shaping, is typically expressed in bits per second (bps). Traffic that is not important and exceeds the average bit rate is buffered.

In general, traffic shaping can be thought of as a trade-off in which a company accepts a lower performance standard for low-priority traffic in exchange for higher performance and stability for high-priority traffic.

What is the Difference Between Traffic Shaping and Traffic Policing?​

The rate of outgoing traffic on an interface is constrained by both outbound traffic policing (TP) and traffic shaping (TS). It's crucial to distinguish between traffic shaping and policing because they are frequently mistaken. The following are the differences between traffic shaping and traffic policing:

Packets with rates higher than the traffic policing rate are immediately discarded by traffic policing. However, traffic shaping buffers packets that are sent at rates higher than the traffic shaping rate and sends them at a constant rate.

While traffic enforcement does not lengthen the delay, traffic shaping does.

Packets exiting an interface are impacted by traffic shaping. Less important packets are sent out more slowly using a leaky bucket mechanism, and the network temporarily holds them in a buffer queue.

Network experts, on the other hand, can set up traffic policing for traffic that enters and leaves an interface. Policing is typically less effective because it just drops packets rather than temporarily keeping them in a queue.

Over time, traffic shaping continuously progresses toward a smooth traffic output objective. Traffic shaping, as opposed to traffic policing, keeps extra packets in a buffer or queue rather than marking them. The extra packets are then sent out over time as traffic allows, creating that smooth curve.

When compared to traffic policing, traffic shaping implies and requires a large enough buffer or queue for the delayed packets. Thus, to enable traffic shaping, memory is required.

Another thing to keep in mind is that traffic shaping, which involves queuing up packets to be sent later, can never be used for inbound traffic. Since inbound traffic is the purview of traffic police, there is no such thing as true inbound traffic shaping. A scheduling function is necessary for traffic shaping so that packets that are delayed can be transmitted later from various queues. Traffic shaping therefore only slows down traffic; it does not stop it. In contrast, traffic enforcement discards data rather than simply delaying its processing.

Comparison of traffic policing and traffic shaping is given in the next table,

Traffic PolicingTraffic Shaping
Traffic policing is a system for keeping an eye on network traffic.The congestion control method known as "traffic shaping" causes packet delays.
Packets whose rates exceed the rate used for traffic policing are rejected.When packet rates exceed the pace of traffic shaping, they are buffered.
Traffic enforcement doesn't lead to delays.Packet delays are caused by traffic shaping.
To calculate token values, bytes per second are employed.In bytes per second, the token values are determined.
Traffic queuing is not done during traffic policing.Traffic shaping does not include traffic queuing.
Traffic noting is supported by traffic policing.Traffic remarking is not supported by traffic shaping.
You can use traffic policing to manage both inbound and outbound traffic.Traffic policing is only effective for limiting outward traffic.

Table 1. Traffic Policing vs Traffic Shaping

What is the Difference Between Traffic Shaping and Quality of Service (QoS)?​

Quality of service (QoS) approach called traffic shaping is established on network interfaces to allow higher-priority traffic to flow at optimal rates even when networks are overloaded. By setting a bandwidth limit for less important packets, traffic shaping reduces the likelihood that more crucial packets are delayed or dropped as they leave the interface.

Although shaping is a part of QoS, it can be used alone.

Shaping is a technique for temporarily buffering data and rejecting packets when necessary to avoid congestion or place a cap on how much bandwidth a connection can utilize. When prioritizing traffic, QoS frequently employs this strategy since different traffic classes are assigned bandwidth caps.

Traffic can be shaped, though, without compromising QoS. There is no prioritizing when there is only one type of traffic, although shaping can still take place. QoS is achieved when different traffic classes are involved.

Although traffic shaping falls under the Quality of Service (QoS) umbrella, traffic shaping, and QoS share the same goal of managing and controlling network traffic. They don't actually compare.

The following are the distinctions between quality of service (QoS) and traffic shaping:

Why is Traffic Shaping Important?​

Traffic shaping is a crucial component of any network firewall and essential for cybersecurity. Despite the fact that bandwidth prioritizing is necessary due to restricted network resources, it ensures a greater quality of service for data and business applications.

Because there is a limited amount of bandwidth available on every network, traffic shaping through bandwidth management is a crucial technique for ensuring the smooth operation of crucial applications and the timely delivery of time-sensitive data.

Application-based traffic shaping, for example, can be used by businesses that rely heavily on online sales to give that data priority both going to and coming from the application. Conversely, those who frequently require speedy responses from the C-suite can use route-based traffic shaping to order messages going to and coming from the executives' inboxes according to their IP addresses.

A strong and adaptable method of protecting against bandwidth-hogging distributed denial-of-service (DDoS) assaults and ensuring quality of service is traffic shaping. It controls abusive users, safeguards networks and applications against traffic peaks, and stops network attacks from depleting network resources.

When network uplinks are clogged with data leaving an interface, traffic shaping is crucial. Without traffic shaping, networks may discard or wait for any extra traffic that cannot exit an interface, which may result in delays for all packets or subpar performance for mission-critical applications.

Network administrators can designate which apps are less crucial by using traffic shaping, which generates knowledge about which packets will be dropped or delayed first. In general, traffic shaping is a crucial method of traffic control that guarantees excellent network performance.

What are the Benefits of Traffic Shaping?​

Traffic shaping enables the efficient operation of crucial business applications and data by ensuring they have the required bandwidth. Traffic shaping ultimately helps to ensure a higher performance level, better quality service (QoS), reduce latency, prevent bufferbloat, maximize available bandwidth, and boost return on investment (ROI).

There are numerous advantages of using a network traffic-shaping device or program:

What are the Challenges and Limitations of Traffic Shaping?​

The requirement for precise network information and the potential for network security breaches are among the drawbacks of traffic shaping. Other drawbacks of traffic shaping are as follows:

How Does Network Traffic Shaping Work?​

Traffic shaping works by applying rules or regulations to traffic entering or leaving a network device such as a router, firewall, or switch. These rules or policies, which depend on factors including source, destination, port, protocol, and application, might determine the maximum or minimum bandwidth, rate, or priority for each traffic class. The network device then stores and processes the incoming or outgoing packets in accordance with the set of rules or policies using a buffer or queue. The network device drops, delays, or flags packets that go beyond the limits or break the rules, depending on the traffic shaping algorithm.

The first step in traffic shaping is classifying the various types of traffic that pass across a network. Businesses that run online stores, for instance, prefer to give transaction traffic priority over traffic related to administrative duties. Customers won't ever have to wait for service, which will improve their experience. However, traffic that originates from systems and applications other than the online store is neither rejected nor ignored. It is merely postponed. The delayed traffic is processed after the network has become less crowded.

Using an application delivery controller, which applies particular traffic shaping rules to the incoming and existing data, the next step after classification is to manage the network capacity.

You can see that it gives high-priority traffic a higher bandwidth allocation, followed by medium-priority traffic and low-priority traffic.

Classifying the various types of network traffic is the first step in putting in place a successful traffic shaping system.

In order to guarantee that this crucial traffic is forwarded normally regardless of how congested the network becomes, businesses could, for instance, prioritize traffic to and from a crucial web service. This implies that some traffic may be prioritized over others. When this occurs, the packets are merely stored in a buffer until a forwarding operation can be performed without going over the configured and desired maximum rate.

The traffic shaping appliance (typically an Application Delivery Controller) starts to govern the bandwidth going into and out of the network once the categorization system is set up.

What are the Traffic Shaping Methods?​

Below is a list of the many traffic shaping methods.

How to Implement Traffic Shaping on OPNSense and pfSense?​

One of the top open-source firewalls, OPNsense, includes a very adaptable and trustworthy traffic-shaping feature. The handling of shaping rules, firewall rules, and other parameters is done individually. You may easily configuring traffic shaping on your OPNsense.

Dummynet and IPFW are used by OPNsense Traffic Shaper to deliver a dependable solution with little CPU usage.

Dummynet uses any match pattern that may be used in ipfw rules to first categorize packets and then divide them into flows. A flow may include packets for a certain protocol type, packets for an entire subnet, packets from/to a particular host, packets for a single TCP connection, and so forth, depending on local restrictions.

In order to implement traffic laws, packets from the same flow are then forwarded to one of the following objects:

Each stage of the traffic shaper setup on pfSense software procedure and an explanation of each page are given in the sections below. You will have a traffic shaper for your home or office network that is completely operational once you have followed these instructions.

  1. Launch the Shaper Wizard: Use the web interface to log into your pfSense machine to get going. Next, select the firewall tab to see the traffic shaping menu. The traffic shaper can be manually configured on pfSense, however, using the traffic shaper wizard and making adjustments as necessary is advised. Select the wizard link that corresponds to your current configuration by clicking the "wizards" tab. You should use the Single LAN, Multi Wan wizard because the pfSense system is configured as a twin WAN router. Use this wizard if your LAN and WAN connections are both the same.
  2. Set the Wan Connection: You must input the number of WAN connections on your router in the following step. Simply put "1" if your WAN router is the only one. If your router has two WAN ports, type "2". If you are unsure about the number of configured interfaces, click the status tab and then choose interfaces.
  3. Configure the Shaper:The LAN scheduler must be chosen as the first option on the shaper configuration page. It is advised to use the HFSC (Hierarchical Fair Service Curve), which is the default. Use PRIQ (Priority queueing), which is simple to change but less effective, if you simply need very minimal shaping. It is advised to write "97%" of the connection's maximum bandwidth in the upload field. For instance, if your ISP offers you an upstream bandwidth of 1 Mbps (1000 Kbps), you would multiply 1000 by 97% to get 970 Kbps. By doing this, you'll make sure that packets are queuing up on your pfSense system rather than a remote upstream router. Enter the connection's maximum download speed in the connection download box. If you are unsure of your connection speed, obtain an estimate by contacting your ISP or doing an internet speed test. To get the best setup for your connection, you might need to make a small adjustment to these parameters.
  4. Configure Voice Over IP: You should probably give the traffic sent by your VoIP phones priority if you use them. To make this setting active, choose the checkbox. Choose your VoIP provider from the list after that. Enter the IP address of your VoIP phone after selecting "generic" if your provider is not mentioned. You can build a Firewall alias that comprises numerous hosts if your network has many VoIP phones. Click the next button with this setting deactivated if you are not utilizing VoIP
  5. Configure Penalty Box: You can put one or more hosts on your network into a "penalty box" to restrict their usage to a specific portion of the available bandwidth if they are taking up the majority of the bandwidth. Similar to the preceding setting, an alias must be created if you need to specify more than one host.
  6. Configure Peer-to-Peer Networking: You can choose whether to de-prioritize peer-to-peer networking traffic in this wizard section. Due to the fact that P2P traffic frequently consumes the most internet bandwidth on a network, almost everyone will want to enable this feature. The traffic shaper will search for each application on your network only if the checkboxes next to them are enabled. The P2P catch-all setting is turned on to punish unclassified traffic. Any traffic that is not specifically categorized in the traffic shaper when this setting is active will be categorized as P2P traffic.
  7. Give Game Traffic Priority: You can give network game traffic priority on the network games page. The latency of game traffic, which is extremely time-sensitive, can be reduced quite well using this. Users on the network can still upload and download files while this setting is active without interfering with gamers. By turning on this option, for instance, players of MMORPG games like World of Warcraft can reduce their ping times.
  8. Configure Additional Apps: Additionally, you can individually increase or decrease the priority given to various applications. Most users will probably wish to give HTTP, DNS, and ICMP higher priority. You can move email up or down the queue depending on how crucial it is to your network. If the wizard is missing any applications you require, you can design your own unique traffic-shaping rules.
  9. Changing the Rules: You can add to or modify the rules produced by the wizard as necessary if the application or protocol you wish to shape was not included by the wizard. The FirewallRules page contains the rules that the shaper created. A list of rules produced by the wizard should appear when you click the "floating" tab. Run the wizard once more and double-check that the applications were enabled if you still can't see the rules. You may occasionally need to select or deselect the checkbox. The choices are not enabled if they are grayed out. If you'd like, you can modify the ports of current rules or write totally new rules. The simplest method to do this is to build a rule that is comparable to an existing rule that already does what you want it to do. To accomplish this, select the rule you wish to duplicate by clicking the + sign next to it. The functions of the queues are largely implied by their names. Open the traffic shaping page accessible in the firewall menu to see a list of all the queues and their current configurations.

What are the Best Practices for Traffic Shaping?​

Traffic shaping is implemented differently by different device makers, but you can generally configure it through your router. Finding the transmission rate is crucial in this situation. Let's use an example to better grasp this.

Let's assume that a network can send information at a rate of 2 Mbps, or 2,000,000 bits per second. However, the bandwidth that your ISP has allocated to you is only 1 Mbps per second, or 1,000,000 bits per second. To ensure that you receive what you paid for, your ISP will therefore have to limit its bandwidth by half. However, in practice, an interface cannot send data at a rate lower than its line speed, which in this case is 2 Mbps. So, in order to accomplish this goal, the ISP will do a start-stop operation in which it sends data for a while, stops it for a while, and then restarts it. To ensure that the final rate of transmission is only 1 Mbps, it could send 500,000 bits in this scenario, pause, and send the final 500,000 bits after 0.5 seconds, or 500 milliseconds. Additionally, albeit more slowly, it makes sure that all 1,000,000 reach the end user simultaneously.

The math can be challenging when you have to establish this traffic shaping rate for each application. Not to worry, though; there is a straightforward formula for this.

Burst size (in bits per second) / time interval (in seconds) give the committed information rate (CIR, in bits per second). A brief explanation:

If you use the aforementioned example, the CIR is 500,000/0.5, or 1,000,000. You can configure your router to customize the transmission rate for various applications based on this calculation and your bandwidth size. Remember that depending on your router, the implementation will change. When setting this up for the first time, it is essential to verify with the manufacturer of your router or seek outside assistance. Moreover, you can use these best practices for traffic shaping.

Real-World Examples of Traffic Shaping​

Depending on the needs and goals of the network administrator, traffic shaping can be used in a variety of network scenarios. Real world use cases of traffic shaping are explained below: