| Traffic shaping | Bandwidth throttling | |
|---|---|---|
| What happens to excess traffic | Buffered and sent later | Dropped or re-marked |
| Effect on delay | Adds some queuing delay | No delay added by the policer itself, although conforming traffic still waits in the normal egress queue when the link is congested |
| Effect on packet loss | Low, until the buffer fills | Immediate for traffic over the limit |
| Traffic direction | Usually outbound | Inbound or outbound |
| Typical use | Matching a slower provider rate, smoothing bursts | Hard caps on guest, recreational, or non-business traffic |
How traffic shaping works
A shaper meters outgoing traffic against a target rate using a token bucket. Tokens refill at the configured rate, and each packet needs enough tokens to leave the interface. When traffic arrives faster than tokens refill, packets wait in a queue instead of being discarded. The result is a smooth, predictable output rate.
The most common use is a subrate circuit. Suppose a branch router connects to the provider over a 1 Gbps Ethernet port, but the contract is for 200 Mbps. Without shaping, the router sends at full port speed, the provider’s equipment typically polices the excess, and packets are lost upstream where you can’t see or control the loss. Shaping keeps the queue on your router, where your own QoS policy decides what waits. Set the shaper slightly below the contracted rate, commonly 90 to 95 percent, because the provider may count Layer 2 overhead that the router’s shaper doesn’t, and traffic shaped to exactly 200 Mbps could still be policed upstream. Confirm the right value with your provider. The example below shapes to 190 Mbps, which is 95 percent of the contracted rate.
policy-map SHAPE-190M
class class-default
shape average 190000000
service-policy WAN-EDGE
!
interface GigabitEthernet0/1
service-policy output SHAPE-190M
Here the outer policy shapes all traffic to 190 Mbps, and the nested WAN-EDGE policy decides the order in which classes are served within that rate. This combination is known as hierarchical QoS. For more on building the WAN-EDGE classes, see what is QoS.
How bandwidth throttling works
A policer measures traffic against a rate using the same token bucket idea, but it has no queue. Packets within the rate pass immediately. Packets over the rate are dropped, or re-marked to a lower priority so that devices further along the path can drop them first if congestion occurs. Throttling is the right tool when you want a firm ceiling. For example, to keep streaming video on a guest network from exceeding 10 Mbps:
class-map match-any STREAMING
match protocol youtube
!
policy-map GUEST-LIMIT
class STREAMING
police cir 10000000 conform-action transmit exceed-action drop
!
interface GigabitEthernet0/2
description Guest network
service-policy output GUEST-LIMIT
The policy is applied outbound on the guest-facing interface, so it limits video downloaded to guest devices. Because a policer works without a queue, it can also be applied to traffic arriving on an interface, which shaping usually can’t be in typical Cisco interface configurations. The trade-off is visible in TCP performance, drops cause senders to slow down and retransmit, so throughput tends to rise and fall around the limit rather than holding steady.
What is ISP throttling?
When people talk about ISP throttling, they usually mean a provider deliberately slowing certain traffic or certain customers, for example after a monthly data allowance is used up or when a plan caps a particular service. The mechanism is the same rate limiting described above, applied in the provider's network rather than yours.
When to use shaping and when to use throttling
Each method suits different situations, and the two can be combined on the same device:
| Scenario | Better choice | Why |
|---|---|---|
| Port speed is higher than the contracted provider rate | Shaping | Keeps the queue under your control instead of letting the provider drop excess traffic |
| Bursty traffic overwhelms a slow WAN link at peak times | Shaping | Smooths bursts without the loss that would force retransmissions |
| Guest Wi-Fi or recreational traffic needs a firm ceiling | Throttling | Enforces a hard cap with no buffering cost |
| Traffic arriving on an interface must be limited | Throttling | Shaping is usually applied to outbound traffic, and typical Cisco interface QoS configurations don’t support it on input |
| Backups and updates should yield to business traffic | Shaping with QoS classes | Lower-priority traffic waits rather than being dropped |
A useful rule of thumb: Shape where delay is acceptable and loss is not, and throttle where a strict limit is more important than smooth delivery.
Where deep packet inspection and NBAR2 fit
Shaping and throttling act on classes of traffic, so both depend on classification first. Matching by port number alone is unreliable, because many applications share port 443 or change ports.
Deep packet inspection (DPI) looks beyond the packet header to identify the application itself. On Cisco routers, this capability is called NBAR2 (Next Generation Network-Based Application Recognition). NBAR2 lets a class map match applications by name, as the match protocol youtube line in the throttling example above does, and Cisco updates its application signatures through protocol packs.
Keep in mind that DPI and NBAR2 only identify traffic. The decision to shape, throttle, or prioritize it still comes from the policy you attach to that class.
Traffic shaping with NetFlow Analyzer
A shaping policy is only as useful as the traffic data behind it. ManageEngine NetFlow Analyzer connects the three steps involved i.e., finding what needs shaping, applying the change, and confirming the result.
- Find the traffic to shape: Drill down from a congested interface to the applications, users, and conversations responsible. NBAR monitoring shows which applications Cisco devices are recognizing on the link. For a step-by-step approach, see how to identify and control bandwidth hogs.
- Apply the policy: With the Network Configuration Manager (NCM) add-on, you can create and update QoS policies on your devices and push ACL commands through configlets, instead of configuring each device by hand. Shaping can be applied at the application, interface, or router level, and the add-on is configured directly from the NetFlow Analyzer interface.
- Confirm the result: CBQoS reports show pre-policy and post-policy traffic, drops, and queuing for each class, so you can see whether the new policy is working or needs adjusting.
The NCM add-on also records who changed which configuration and when, and keeps configuration backups for devices under monitoring, which makes it easier to review or roll back a policy change. The policies themselves are enforced by your network devices; NetFlow Analyzer provides the visibility and the configuration workflow around them. Explore NetFlow Analyzer's bandwidth management features or see how CBQoS reporting validates your policies. For a hands-on experience download a free, fully functional 30-day trial of NetFlow Analyzer now.
Frequently asked questions
Does traffic shaping add latency?
Yes, but only for packets that have to wait in the shaping queue. The added delay depends on how deep the queue is and how far traffic demand exceeds the shaped rate. To keep voice and video unaffected, add a priority class inside the shaper, as in the hierarchical QoS example above. Delay-sensitive traffic is then sent first, ahead of everything else in the queue.