This KB article explains the impact of applying a policer on interface throughput and how to observe the changes in statistics before and after applying the policer.
It covers the effect of microbursts and adjusting the burst-size-limit for optimal performance.
After applying a policer, you may notice a significant drop in throughput, especially when the average traffic rate is lower than the policer limit.
Some applications may experience slowdowns or packet loss due to traffic exceeding the burst size.
Configuration of Policer:
-------------------------
The policer was initially configured with a 100 Mbps bandwidth limit and a 10k burst-size-limit.
Initial Policer Configuration:
-------------------------------
policer CUSTOM_POLICER {
if-exceeding {
bandwidth-limit 100m; # 100 Mbps limit
burst-size-limit 10k; # Initial burst size limit (10k)
}
then discard;
Before and After Applying the Policer:
--------------------------------------
To understand the impact of applying the policer on interface statistics, observe the throughput and input bytes before and after the policer is applied.
Before Applying the Policer:
The following command shows the throughput before the policer is applied. We can see that the average throughput is 80 Mbps:
root@srx1> show interfaces ge-0/0/5 extensive | match "Input bytes"
---(refreshed at 2025-02-26 16:58:54 UTC)---
Input bytes : 67999974000 80045023 bps <-- 80 Mbps
Input bytes: The total input bytes received by the interface.
80 Mbps: The average throughput on the interface, indicating that the traffic is well below the policer limit (if configured).
After Applying the Policer:
---------------------------
After the policer is applied, you will notice a decrease in the throughput, as shown in the following command output:
---(refreshed at 2025-02-26 17:00:00 UTC)---
Input bytes: 469,765,234,545
Input bytes: 179,028
Input bytes: 469,765,055,234 15 Mbps
Input bytes: The total number of input bytes remains the same, but the throughput shows a significant drop to 15 Mbps.
Policed Packets After Policier is Applied:
After applying the policer, you can use the following command to check the policed packet statistics:
root@dns5-fc-edg-fw-a-1> show firewall filter PHYSEC_IN_QOS
Feb 26 17:00:21
Filter: PHYSEC_IN_QOS
Counters:
Name Bytes Packets
PHYSEC_POLICING_IN_COUNTER 5350288 4260
Policers:
PHYSEC_POLICER-PHYSEC_POLICING_IN 462076 334
Policer Counters: Now that the policer is in effect, the 462,076 bytes and 334 policed packets are counted, reflecting how the policer is limiting traffic.
Policed Packets: These statistics show how many packets were dropped after exceeding the burst size or bandwidth limit, based on the configuration.
The throughput reduction indicates that the policer is actively dropping packets that exceed the configured limit.
The throughput exceeding the 100 Mbps on the link may not be visible because the interface statistics are calculated over a larger interval. These statistics do not detect microbursts at lower levels of granularity (for example, milliseconds) that trigger the policer beyond 100 Mbps. Interface statistics typically show the average throughput over longer time intervals, which may smooth out the spikes and fail to reflect the microbursts that cause temporary spikes above the policer threshold.
Identifying Microbursts:
------------------------
Capture external traffic before the firewall.
Open Wireshark and adjust Statistics > I/O Graphs:
Set the Tick Interval to 0.001 seconds (1ms).
Change the Y-Axis Unit to bits/Tick.
Convert the Mbits/sec rate into bits per 1ms.
If the traffic spikes above the policer threshold within 1ms, microbursts are likely causing the issue.
In this example , the captured traffic rate observed in Wireshark has reached 270,000 bits per 1ms in burst.
Convert the observed bits into bytes:
270,000 bits ÷ 8 = 33,750 bytes
The policer is configured for 100 Mbps, and since 1 Mbps = 1,000,000 bits per second, this is equivalent to:
100,000,000 bits per second ÷ 1000 ms = 100,000 bits per 1ms
Convert the 100,000 bits into bytes:
100,000 bits ÷ 8 = 12,500 bytes per 1ms
Therefore, the policer bandwidth limit is 12,500 bytes per 1ms.
Excess Traffic (microburst difference) is calculated as:
33,750 bytes - 12,500 bytes = 21,250 bytes
Thus, the observed traffic exceeded the policer limit by 21,250 bytes.
Adjusting the Burst Size:
As per Juniper's documentation on determining burst sizes, the typical method for estimating burst size is the 5ms method.
Juniper Documentation Reference
To accommodate microbursts observed through Wireshark based on the above calculation, adjust the burst-size-limit as follows:
burst-size-limit 21,250; # Increased burst size to accommodate observed microburst from 10k to 21k