QoS · Topic 3 of 3
Traffic Shaping and Bandwidth Limits with Queues
Limit and shape bridged traffic in RouterOS with simple queues and queue trees, see how shaping differs from policing, and why offload skips queues.
- 4 min
- Shaping delays packets in a queue, and policing drops them.
- A simple queue has a
targetand amax-limitof upload and download. - A queue tree needs a
parentand a packet mark from mangle.
What it is
Traffic shaping controls how fast data is sent, by holding packets in a queue and releasing them at a set rate.
RouterOS does this with queues. A queue has a maximum rate, and packets above that rate wait in the queue, instead of being dropped at once.
On a switch, queues apply to traffic that the CPU handles. This page explains how to use them for a bridge, and when they are not the right tool.
How it works
Queues are rules that match traffic, set a rate and decide what happens at the limit.
Shaping and policing
The two ways of limiting traffic behave differently.
| Method | What happens above the rate | Effect |
|---|---|---|
| Shaping | Packets wait in a queue, then go out | Smooth traffic, adds delay |
| Policing | Packets above the rate are dropped | No delay, but loss and bursts |
Shaping gives a better experience for TCP, because senders slow down gradually. Policing is simpler and uses less memory. Queues in RouterOS shape, and they drop packets only when the buffer is full.
Simple queues
A simple queue limits a target in one rule.
/queue simple add name=guest-limit target=192.168.88.0/24 max-limit=10M/20MThe target is who the rule applies to, and max-limit has two values: upload and download, written as upload first. For a bridge, the target can also be an interface, so a rule limits all traffic of a port.
/queue simple add name=port-limit target=ether3 max-limit=5M/5MQueue trees
A queue tree is more flexible, but needs marked packets.
/ip firewall mangle add chain=forward action=mark-packet new-packet-mark=guest passthrough=no src-address=192.168.88.0/24
/queue tree add name=guest-q parent=ether1 packet-mark=guest max-limit=10MThe parent is an interface or another queue. The packet-mark links the queue to the traffic that the mangle rule marked. A queue tree on an interface limits traffic that leaves through that interface.
Queues on a bridge
For traffic that crosses a bridge, the CPU must see it.
A bridge only passes bridged IP traffic through the IP firewall when you enable that option.
/interface bridge settings set use-ip-firewall=yesWith it, mangle rules can mark bridged packets, and queues can limit them. Without it, the firewall does not see traffic that is only bridged.
Queue types
The queue type decides how packets inside the queue are handled.
- FIFO types: first in, first out. Simple and cheap.
- SFQ: shares the rate among connections.
- PCQ: creates one sub queue per host or flow, so each gets an equal share.
- RED: drops packets early to signal congestion.
PCQ is the usual choice to give every user an equal part of a link.
Why queues do not suit offloaded traffic
Queues work in the CPU, and a switch chip never involves the CPU.
Frames that are forwarded by hardware do not reach the queue. A queue on such a port has no effect, or it forces traffic into the CPU path and ends offload. For chip switched traffic, use the rate limits in the switch chip instead.
A queue rule on a hardware switched bridge may not limit anything. Test the rate after you apply it.
Choosing the tool
| Need | Use |
|---|---|
| A plain limit per port, at wire speed | Chip rate limit |
| A limit per host or network | Simple queue |
| Priorities and several classes | Queue tree with marks |
| Fair share among many users | PCQ queue type |
Checking
/queue simple print stats
/queue tree print statsThe counters show the current rate and the packets dropped by each queue.
What to remember for the exam
Seven facts cover most questions on this topic.
- Shaping delays packets in a queue, and policing drops them.
- A simple queue has a
targetand amax-limitof upload and download. - A queue tree needs a
parentand a packet mark from mangle. - Bridged IP traffic reaches the firewall only with
use-ip-firewall=yes. - PCQ gives each host an equal share.
- Queues run on the CPU and do not apply to hardware switched frames.
- Use chip rate limits for plain port limits at wire speed.
Queues only act on traffic that leaves an interface, so a limit in both directions needs rules for each direction.
Common mistakes
These four mistakes appear often.
Limiting offloaded traffic with a queue. The frames never reach the queue.
Forgetting use-ip-firewall on a bridge. Mangle never sees bridged packets, so queue trees never match.
Mixing up upload and download. The max-limit values are in a fixed order, upload first.
Setting the limit above the link speed. The queue never fills, so no shaping happens.
Check yourself
Work through these three questions.
What is the difference between shaping and policing?
Shaping holds packets in a queue and sends them at the set rate, and policing drops packets above the rate.
What setting lets mangle and queues see bridged traffic?
use-ip-firewall=yesin/interface bridge settings.Why can a queue fail to limit a CRS port?
Hardware switched frames do not go through the CPU, so the queue never sees them.
Topic 3 of 3 in QoS
Test yourself on QoS
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.