Network & Infrastructure / IPv6, TCP & Transport Engineering
Microbursts through a policer despite low average utilization
A WAN link averages well below its rate limit but drops short application bursts. Minute-level graphs hide traffic that exceeds the policer's instantaneous token budget.
Environment and inputs: Dual-stack routed networks and transport endpoints; validate the complete path and the active operating-system version. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record policing parameters, burst allowance, drop counters and high-resolution traffic samples at the actual enforcement point. Compare ingress shaping and the provider's documented service contract.
Explain the result
Averages describe accumulated traffic over an interval, while policing acts on shorter arrival patterns. A compliant average can still contain bursts that exceed the allowed envelope.
Plan the fix
Align shaping and burst behavior with the real downstream contract, then assess application pacing and queueing needs. Do not infer spare instantaneous capacity from a low daily average.
Check the result and rollback
Replay representative bursts while measuring loss, latency and completion time. Revert if added shaping creates unacceptable delay or fails to match the provider's actual enforcement behavior.