Linux Traffic Control

Linux Traffic Control
Name	Linux Traffic Control
Caption	Kernel packet scheduler and queuing disciplines
Developer	Linus Torvalds
Released	2000s
Repo	Linux kernel
Platform	Linux
License	GNU General Public License

Linux Traffic Control is the kernel-level packet scheduling subsystem in Linux kernel that implements bandwidth management, latency control, and packet prioritization for network interfaces. It provides mechanisms to shape, police, classify, and queue packets using modular components, enabling administrators to implement quality of service (QoS) policies for servers, routers, and embedded systems. Built into the Netfilter and Traffic Control (tc) ecosystems, it integrates with kernel features and user-space tools to manage traffic across physical and virtual interfaces.

Overview

Traffic control in Linux kernel exposes a programmable framework for controlling egress packet transmission on network devices such as Ethernet, Wi-Fi, and TAP devices. It is commonly used in deployments involving ISP edge routers, data center aggregation, cloud computing platforms like OpenStack, and network function virtualization projects such as Open vSwitch and DPDK. Administrators combine classification, queuing disciplines, and filters to meet service level objectives in contexts including VoIP carriers, content delivery network nodes, and campus networks managed by teams using tools from Red Hat, Canonical, and SUSE.

Architecture and Components

The architecture centers on kernel components: queuing disciplines (qdiscs), classes, filters, and actions. Qdiscs attach to network device egress queues in the Linux kernel and implement packet enqueue/dequeue semantics; common kernel subsystems in this area include Netlink for control plane communication and tc (Linux), which uses libnl and genetlink to configure parameters. Filters use classifiers such as the u32 classifier, fw (firewall) classifier, and flower classifier to match packets by headers and metadata, interoperating with kernel modules from iptables, nftables, and XDP. Actions perform modifications like marking, mirroring, or dropping and can interact with cgroups and systemd for per-process policy.

Configuration and Tools

Configuration is typically performed with the userland utility tc (Linux), augmented by helpers like iproute2, iproute, ip, and modern management stacks including NetworkManager, systemd-networkd, and orchestration tools such as Ansible, Terraform, and Kubernetes. Vendors and projects provide GUIs and wrappers: OpenWrt integrates tc via UCI, while pfSense and VyOS expose shaping features in web and CLI interfaces. Monitoring relies on ethtool, sar, collectd, Prometheus, and Grafana dashboards, with kernel statistics surfaced by procfs and sysfs.

Queuing Disciplines and Algorithms

Linux includes a variety of qdiscs and algorithms tailored to different objectives. Classical disciplines include FIFO and SFQ; hierarchical and classful systems include HTB and CBQ. Advanced algorithms for fairness and latency reduction include fq_codel and cake, which target bufferbloat remediation in consumer and carrier networks. Scheduler implementations range from simple token bucket meters to complex deficit round-robin and weighted fair queuing schemes used in enterprise platforms from Cisco Systems and Juniper Networks equivalents. The kernel also supports stochastic fair queueing and low-latency queuing suitable for real-time workloads common in telecommunications and industrial control systems.

Shaping, Policing, and Scheduling

Shaping smooths bursty traffic by buffering and pacing egress according to rate parameters, implemented by qdiscs like HTB and token bucket filters derived from standards in RFC literature. Policing enforces absolute rate limits by dropping or remarking packets, used in service contracts between ISP peers and in carrier-grade NAT contexts such as those managed by Juniper Networks and Ericsson. Scheduling maps classes to priorities and weights, enabling weighted bandwidth allocation for tenants in cloud computing infrastructures from Amazon Web Services, Google Cloud Platform, and Microsoft Azure or for virtualized network functions in NFV deployments.

Examples and Use Cases

Common use cases include rate-limiting a virtual machine interface in KVM hosts, shaping traffic for container ingress/egress in Docker or Kubernetes clusters, and prioritizing latency-sensitive flows for VoIP gateways and WebRTC services. ISPs use tc-based policies for traffic engineering and congestion management in backbone and access networks, while enterprise security stacks combine tc with iptables or nftables to throttle malicious flows. Embedded projects like OpenWrt and DD-WRT use lightweight qdisc setups for home gateways; academic research platforms in universities such as MIT, Stanford University, and ETH Zurich employ Linux traffic control for experimental network protocols.

Troubleshooting and Performance Tuning

Troubleshooting begins with inspecting qdisc state via tc (Linux) show commands and examining kernel counters through ss, netstat, and ethtool. Latency and bufferbloat are diagnosed using active measurement tools inspired by Bufferbloat research and mitigated by deploying fq_codel or cake. Performance tuning often requires matching qdisc configurations to NIC offload capabilities and interrupt moderation features present in drivers from Intel Corporation and Broadcom. When diagnosing packet loss, engineers consult kernel logs, driver statistics, and hardware counters, coordinating with observability stacks like ELK Stack and Prometheus to correlate events.

Category:Linux networking