Content

| 8.4 |  | Policing and Marking |
| 8.4.4 |  | Token bucket |

Policing uses a token bucket algorithm. As each frame is received by the switch, a token is added to the bucket. The bucket has a hole in it and leaks at a rate that is specified as the average traffic rate in bits per second. Each time a token is added to the bucket, the switch performs a check to determine if there is enough room in the bucket. If there is not enough room, the packet is marked as nonconforming, and the specified policer action is taken, dropped or marked down.

How quickly the bucket fills is a function of the bucket depth, or burst-byte, the rate at which the tokens are removed, rate-bps, and the duration of the burst above the average rate. The size of the bucket imposes an upper limit on the burst length and determines the number of frames that can be transmitted back-to-back. If the burst is short, the bucket does not overflow, and no action is taken against the traffic flow. However, if a burst is long and at a higher rate, the bucket overflows and the policing actions are taken against the frames in that burst.

TThe bucket depth, the maximum burst that is tolerated before the bucket overflows, is configured by using the burst-byte option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. The rate or average at which tokens are removed is configured using the rate-bps option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command.