Lab 07-01 · Simple queue: put a speed limit on one laptop¶

Your little brother starts downloading a 100 GB game. Suddenly your video call freezes, your online match lags and the whole house shouts "who is using the Internet?!". The line is the same as five minutes ago. What changed is that one device is eating almost all of it.

Every café, school and hotel WiFi has this problem, and every one of them solves it the same way: the router gives each device a speed limit. Today you will put one on your own laptop, measure it with real tools, and discover why a brand-new MikroTik router can ignore your limit completely.

Quality of service in one paragraph¶

QoS (quality of service) is how well a network serves its users: how fast, how stable, how fair.

RouterOS has several QoS tools. This module uses the most common one: rate limiting (also called shaping), which means not letting some traffic go faster than a chosen speed.

Here is the analogy for the whole lab. The link to the Internet is a motorway and every packet is a car. A queue is a toll gate: it lets cars through at a fixed pace. If cars arrive faster than that, they wait in line (they are queued), and if the line gets too long, the newest ones are turned away (dropped).

flowchart LR
    I["<b>Internet</b><br>sends as fast as it can"] -- "cars arrive<br>at 1 Mbps" --> Q
    subgraph R1["r1 · your router"]
        Q["<b>Queue</b> (toll gate)<br>lets 256k through<br>the rest waits or is dropped"]
    end
    Q -- "256k" --> L["<b>Laptop</b><br>192.168.88.200"]

Bits, bytes and the ÷8 trap (again)¶

Speed limits in RouterOS, like Internet contracts, are in bits per second:

But your browser and curl show bytes per second. You met this in Unit 1: lowercase b is a bit, uppercase B is a byte, and there are 8 bits in a byte. A 256k limit is 256 ÷ 8 = 32 kB/s. If you see 32 kB/s and think "my limit is broken, I asked for 256", you fell into the ÷8 trap.

Simple queues¶

A simple queue is a speed limit for one target (an address, a network or an interface), with one value for upload and one for download.

The key fields (WinBox Queues → Simple Queues → +):

Upload and download are always seen from the target's point of view: upload is what the laptop sends, download is what it receives. In the CLI both go in one field, max-limit=upload/download.

FastTrack: the electronic toll lane¶

A new MikroTik router comes with a firewall rule called FastTrack (defconf: fasttrack). It marks established connections so that their packets skip most of the router's work: the firewall, connection tracking... and the queues. It is like the electronic toll lane on a motorway: cars with a tag drive straight through and never stop at the gate. Great for speed, terrible for your speed limit.

That is why the course says (slide 288): disable the FastTrack rule so that the simple queue works.

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>web + iperf3 server"]
    CAP["<b>class-ap</b><br>class gateway<br>10.0.0.1 · 198.51.100.1"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>DHCP client: 10.0.0.x"]
        BR["<b>bridge1</b> (LAN)<br>192.168.88.1/24<br>ports ether3, ether4"]
    end
    PC1["<b>pc1</b> · your laptop<br>192.168.88.200"]
    PC2["<b>pc2</b><br>192.168.88.201"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    WAN --- BR
    BR ---|"ether3"| PC1
    BR ---|"ether4"| PC2

The course asks for the laptop at 192.168.XY.200. This lab uses the factory LAN, so XY = 88 and the laptop is 192.168.88.200: a static lease on r1 always gives that address to pc1.

iperf3 is the tool network engineers use to measure speed: a client sends (or receives) as much data as it can to an iperf3 server for a few seconds and reports the rate in bits per second.

Start the lab¶

Download the lab files and unzip them: 07-01-simple-queue.zip. Open a terminal inside the 07-01-simple-queue folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. Then open the router and the laptop in two terminals:

ssh admin@clab-mtcna-07-01-r1            # password: admin
docker exec -it clab-mtcna-07-01-pc1 bash

At any moment you can run ./check.sh (with CLAB_EXEC="docker exec" on your PC) to see which parts are already solved. It measures real speeds, so it takes about a minute.

Step 1 · Measure the speed without limits¶

You cannot prove a limit works if you do not know the speed before it. On pc1:

ip -br address show eth1                     # expect 192.168.88.200/24
iperf3 -c 198.51.100.10 -R -t 6              # -R = Reverse: the server sends, you download
iperf3 -c 198.51.100.10 -t 6                 # you upload

Look at the last two lines (sender / receiver). Expected: about 1 Mbits/sec both ways (the free CHR licence cap).

Done when you have both numbers written in your report.

Step 2 · Disable FastTrack¶

On a factory router, any queue you create would be skipped by fast-tracked packets. Switch the rule off first.

WinBox: IP → Firewall → Filter Rules, select defconf: fasttrack, click the ✗ (disable) button.

/ip firewall filter print
/ip firewall filter disable [find where action=fasttrack-connection]
/ip firewall filter print where action=fasttrack-connection

Expected: the rule is still there, but now with the flag X (disabled). Do not delete it: on a real router you will want to turn it back on when you remove your queues.

Now look at the FastTrack counters:

/ip settings print

In the virtual lab you will see ipv4-fast-path-active: no and ipv4-fasttrack-packets: 0: these virtual cards cannot fast-track at all (see the warning above). On a hAP, the packet counter climbs fast during a download while the rule is enabled.

Done when the FastTrack rule shows the X flag.

Step 3 · Create the simple queue¶

Now the toll gate. The course asks for upload 128k, download 256k for the laptop.

WinBox: Queues → Simple Queues → +. Name laptop, Target 192.168.88.200, Max Limit: Target Upload 128k, Target Download 256k. OK.

/queue simple add name=laptop target=192.168.88.200/32 max-limit=128k/256k
/queue simple print

Expected: one queue laptop, target=192.168.88.200/32, max-limit=128k/256k.

Done when the queue is listed without the X or I flags.

Step 4 · Watch it with Torch¶

Torch is the router's real-time traffic monitor: pick an interface and it shows every flow passing through it right now, with its speed. Start a long download on pc1:

iperf3 -c 198.51.100.10 -R -t 30

While it runs, on r1 (WinBox: Tools → Torch, Interface bridge1, Src. Address 192.168.88.200, Start):

/tool torch interface=bridge1 src-address=192.168.88.200/32

Press Ctrl+C to stop Torch. Expected: one TCP line between 192.168.88.200 and 198.51.100.10 port 5201, with TX around 250 kbps. TX is what the router sends out of bridge1, so towards the laptop: the download. The queue itself also counts:

/queue simple print stats

The rate= field shows upload/download, for example rate=9.6kbps/255.2kbps, and dropped= counts the cars turned away at the gate.

Done when you have seen the download at about 250 kbps in Torch.

Step 5 · Download "RouterOS" and do the ÷8 maths¶

The course asks you to download the current RouterOS from www.mikrotik.com/download. In the lab, the web server has a 2 MiB file playing that role. On pc1:

ping -c 2 www.mikrotik.com                      # the name resolves to 198.51.100.10
curl -o /dev/null http://www.mikrotik.com/routeros.npk

curl shows a progress meter. Watch the Average Dload column: about 30k, and the download takes about 67 seconds. That k is kilobytes. Check it:

• File: 2 MiB = 2,097,152 bytes × 8 = 16,777,216 bits.
• Limit: 256k = 256,000 bits per second.
• Time: 16,777,216 ÷ 256,000 ≈ 65.5 s. Speed in bytes: 256,000 ÷ 8 = 32,000 bytes/s.

The real numbers are a little worse because every packet also carries headers (addresses, ports...) that count against the limit but are not part of the file.

Last, prove the limit is only for the laptop. On pc2 (docker exec -it clab-mtcna-07-01-pc2 bash):

iperf3 -c 198.51.100.10 -R -t 6 -p 5202

Expected: about 1 Mbps again. pc2 is not the queue's target.

Done when your report has the curl time and the calculation. Run ./check.sh: it must say lab mtcna-07-01 solved.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• QoS is how well a network serves its users; rate limiting is the QoS tool that caps speed.
• A router limits downloads indirectly: it delays and drops packets, and TCP slows down to fit.
• A simple queue limits one target; max-limit=upload/download, seen from the target.
• The factory FastTrack rule lets packets skip the queues: disable it when you use simple queues.
• Torch shows live traffic per flow; /queue simple print stats shows what the queue is doing.
• Limits are in bits per second, downloads show bytes: 256k ÷ 8 = 32 kB/s.

Quick check¶

Next, you will change this queue so that it no longer limits the laptop everywhere, but only when it talks to one particular server.