Lab 07-03 · Guaranteed bandwidth: limit-at and max-limit¶

MTCNA

Module 7 · QoS. Official course slides 293–296: guaranteed bandwidth (limit-at), the example of a parent queue shared by three clients, and how to read guaranteed vs real bandwidth in the queue list. The slides have no LAB block for this part; this lab turns their example into one you can measure.

Two people share a flat and one Internet line. One of them works from home and needs a stable video call from 9 to 5. The other one downloads films. A speed limit (max-limit) alone does not solve it: you can stop the film fan from taking everything, but you cannot promise the worker a minimum. What the worker needs is a guarantee: "whatever happens, you always get at least this much".

That is what this lab builds: a shared line where each person has a guaranteed slice, and can still borrow the other's slice when it is unused.

What you will learn

Tell apart the guaranteed rate (limit-at, CIR) and the maximum rate (max-limit, MIR)
Build a parent queue for the whole line and child queues for each client
Measure how two downloads share a line without guarantees (spoiler: unfairly)
Give one client a bigger guarantee and prove it with two simultaneous downloads
Explain why a client with a small guarantee can still use the whole line when it is alone

Two numbers per client: the floor and the ceiling¶

limit-at is the guaranteed rate: the client always gets at least this much, if it asks for it. Networking jargon calls it CIR (committed information rate).

max-limit is the maximum rate: the client never gets more than this. Jargon: MIR (maximum information rate).

Think of the motorway again, now with lanes. The whole road (the parent queue) has a total capacity. Each client has its own reserved lane (limit-at) that nobody else may take. When a reserved lane is empty, the other cars may borrow it, up to their own speed limit (max-limit).

flowchart TB
    subgraph P["<b>Parent queue 'total'</b> · max-limit 800k (the whole road)"]
        C1["<b>child pc1</b><br>limit-at 600k (reserved lane)<br>max-limit 800k"]
        C2["<b>child pc2</b><br>limit-at 200k (reserved lane)<br>max-limit 800k"]
    end
    C1 --> PC1["pc1 · 192.168.88.200"]
    C2 --> PC2["pc2 · 192.168.88.201"]

The rule the router follows, in order:

Every child first gets its limit-at (if it wants that much).
Whatever is left of the parent's max-limit is shared among the children that want more (the course: "the remaining traffic is split between clients on a first come, first served basis").
No child ever goes above its own max-limit, and all together never above the parent's.

With our numbers: 600k + 200k = 800k, the whole parent. When both download, pc1 gets ~600k and pc2 ~200k. When pc2 is idle, pc1 can borrow its lane and go up to 800k, and the other way round.

Parent and child queues

A simple queue can have a parent: another simple queue that contains it. The parent sets the total; the children split it. In WinBox it is the Parent field in the Advanced tab; in the CLI, parent=total. The slides' example has three clients under a 10 Mbit parent; ours has two under 800k.

Why 800k and not the slides' 1 Mbit?

The virtual routers run the free CHR licence, which caps each port at about 1 Mbps. The parent must be below that cap, or the cap (not your queue) would decide who gets what.

The scenario¶

The router starts from the factory configuration with FastTrack already disabled (you did that in Lab 07-01) and no queues.

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>iperf3 on ports 5201 and 5202"]
    CAP["<b>class-ap</b><br>10.0.0.1 · 198.51.100.1"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>10.0.0.x"]
        BR["<b>bridge1</b><br>192.168.88.1/24"]
    end
    PC1["<b>pc1</b><br>192.168.88.200"]
    PC2["<b>pc2</b><br>192.168.88.201"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    WAN --- BR
    BR ---|"ether3"| PC1
    BR ---|"ether4"| PC2

Node	Role	Address
`internet`	Two iperf3 servers, so both PCs can measure at the same moment	`198.51.100.10` ports 5201, 5202
`class-ap`	Class gateway, DNS, NAT	`10.0.0.1/24`, `198.51.100.1/24`
`r1`	Your router, FastTrack disabled, no queues	WAN by DHCP, LAN `192.168.88.1/24`
`pc1`	The worker's laptop	`192.168.88.200`
`pc2`	The film fan's laptop	`192.168.88.201`

Why ether2 and not ether1?

On a real hAP the Internet port is ether1. In the virtual lab ether1 is reserved for the lab itself (containerlab uses it to manage the router), so the Internet port is ether2 and the LAN ports start at ether3. Never touch ether1 in these labs.

Start the lab¶

Download the lab files and unzip them: 07-03-guaranteed-bandwidth.zip. Open a terminal inside the 07-03-guaranteed-bandwidth folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. You need three terminals:

ssh admin@clab-mtcna-07-03-r1            # password: admin
docker exec -it clab-mtcna-07-03-pc1 bash
docker exec -it clab-mtcna-07-03-pc2 bash

./check.sh (with CLAB_EXEC="docker exec") tells you at any moment what is already solved.

To start two downloads at the same moment, type each command in its PC's terminal and press Enter in one, then quickly in the other. Each one lasts 15 seconds, so a second of difference does not matter.

Step 1 · Two downloads, no rules¶

On pc1 and pc2 at the same time:

iperf3 -c 198.51.100.10 -R -t 15 -p 5201      # on pc1
iperf3 -c 198.51.100.10 -R -t 15 -p 5202      # on pc2

Expected: together about 1 Mbps (the licence cap), but rarely split in half. In our test pc1 got 210 kbps and pc2 734 kbps. Two TCP downloads do not share politely: whoever is "luckier" with lost packets ends up with more.

Check yourself

Write both numbers. Run the test twice: is the split the same each time?

Done when you have seen that, without rules, the split is unpredictable.

Step 2 · Build the parent and the children¶

First the whole road: a parent queue for the LAN with a total of 800k each way. Then one child per laptop, each allowed up to the full 800k.

WinBox: Queues → Simple Queues → +. Name total, Target 192.168.88.0/24, Max Limit 800k / 800k. Then + again: Name pc1, Target 192.168.88.200, Max Limit 800k / 800k, and in the Advanced tab Parent total. Same for pc2 with 192.168.88.201.

/queue simple add name=total target=192.168.88.0/24 max-limit=800k/800k
/queue simple add name=pc1 parent=total target=192.168.88.200/32 max-limit=800k/800k
/queue simple add name=pc2 parent=total target=192.168.88.201/32 max-limit=800k/800k
/queue simple print

Repeat the two simultaneous downloads of Step 1.

Expected: now about 419 kbps each. With no guarantees, the parent shares the leftover equally between the children that want it. Fair, but the worker still has no promise.

Children must really be children

Simple queues are checked from top to bottom, and a packet is handled by the first queue that matches it. A queue for 192.168.88.0/24 that is not the parent of the laptop queues, sitting above them, would swallow all the LAN traffic and the laptop queues would never count a packet. With parent=total the router knows that pc1 and pc2 live inside total.

Check yourself

Why must the parent's target (192.168.88.0/24) include both children's targets?

Done when /queue simple print shows total and two children with parent=total, and the download splits roughly in half.

Step 3 · Guarantee 600k to the worker and 200k to the film fan¶

Now the reserved lanes. The course: set limit-at in the Advanced tab.

WinBox: double-click pc1 → Advanced → Limit At 600k / 600k. Double-click pc2 → Limit At 200k / 200k.

/queue simple set pc1 limit-at=600k/600k
/queue simple set pc2 limit-at=200k/200k
/queue simple print

Repeat the two simultaneous downloads.

Expected: pc1 about 630 kbps, pc2 about 210 kbps. While they run, look at the queues on r1:

/queue simple print stats

The slides (slide 296) show the same thing in WinBox's Queues list: the Limit At column is the guaranteed bandwidth and the Rate column is the real bandwidth right now.

Check yourself

pc1 + pc2 add up to about 840 kbps, a bit more than 800k. Why can iperf3's number differ slightly from the queue's?
What would happen if you gave pc1 limit-at=700k and pc2 limit-at=700k under an 800k parent?

Done when pc1 clearly gets more than pc2 in the simultaneous test.

Step 4 · Alone, the small lane can use the whole road¶

A guarantee is a floor, not a ceiling. Stop pc1 and run only pc2:

iperf3 -c 198.51.100.10 -R -t 10 -p 5202      # on pc2, alone
curl -o /dev/null http://www.mikrotik.com/routeros.npk

Expected: about 790 kbps in iperf3, close to its max-limit (800k), and curl around 95 kB/s (790 ÷ 8 ≈ 99 kB/s, minus headers). The film fan borrows the worker's empty lane, and gives it back the moment the worker starts a call.

Check yourself

Explain with the lane analogy why pc2 can reach 800k although it is only guaranteed 200k.
In the flat example, what would happen during the video call if pc2 had limit-at=0 and pc1 had no queue at all?

Done when pc2 alone reaches close to 800k. Run ./check.sh: it must say lab mtcna-07-03 solved.

If something goes wrong¶

Symptom	Likely cause	Fix
The split does not change after setting limit-at	The children have no parent	`/queue simple set pc1 parent=total` (and pc2)
Only the first queue ever counts traffic	A non-child queue for the whole LAN sits above the laptop queues	Make it their parent (`set pc1 parent=total`), or `move` it below them
pc1 never goes above 600k, even alone	You set max-limit=600k instead of limit-at	`/queue simple set pc1 max-limit=800k/800k limit-at=600k/600k`
Both PCs get about the same	You started the tests far apart, or one test failed	Start them within a second; check both printed results
`iperf3: the server is busy`	Both PCs used the same port	pc1 uses `-p 5201`, pc2 uses `-p 5202`

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

limit-at (CIR) is the guaranteed minimum; max-limit (MIR) is the maximum.
A parent queue holds the total; child queues split it.
Children first get their limit-at; the leftover is shared; nobody exceeds its max-limit.
Without guarantees, two TCP downloads share a line unpredictably.
A guarantee is a floor: an unused guaranteed lane can be borrowed by others.

Quick check¶

1. In a simple queue, which field is the guaranteed rate?

limit-at
max-limit
burst-limit
target

limit-at (CIR) is the rate the client always gets if it asks for it. max-limit (MIR) is the ceiling. Burst is a different feature (next lab).

2. Parent 800k. pc1 has limit-at 600k, pc2 has limit-at 200k, both max-limit 800k. Both download at full speed. What do they get?

About 600k for pc1 and 200k for pc2
About 400k each
About 800k each
About 200k for pc1 and 600k for pc2

Each child first receives its limit-at. 600k + 200k = 800k, the whole parent, so nothing is left to share and each stays at its guarantee.

3. Same queues, but now pc1 is switched off. How fast can pc2 download?

Up to about 800k, its max-limit
Only 200k, its limit-at
Up to 1,000k, the speed of the line
Nothing, because pc1's lane is reserved

limit-at is a floor, not a ceiling. pc1's unused guarantee is borrowed by pc2, up to pc2's own max-limit (800k), which is also the parent's.

4. Without any queue, two PCs download from the same server at the same time. What did the lab show?

They can share the line very unevenly, for example 210k and 734k
They always get exactly half each
The first one gets everything and the second one nothing
Both get the full line speed

TCP reacts to lost packets, and the losses do not hit both downloads equally. Without a queue the split is unpredictable; queues make it a decision.

5. What is the job of the parent queue 'total'?

It sets the total that its child queues share between them
It guarantees bandwidth to the router itself
It limits only the traffic that matches no child
It makes the child queues faster than their max-limit

The parent has the max-limit of the whole "road". The children split it according to their limit-at and max-limit.

6. A hotel has a 100 Mbit line and 4 conference rooms. Each room must always have at least 20 Mbit, and may use up to 100 Mbit when the others are quiet. Pick the two settings each room's child queue needs.

limit-at=20M
max-limit=100M
limit-at=100M
max-limit=20M

The guarantee is the limit-at (20M × 4 = 80M, inside the 100M parent). Borrowing up to the full line is allowed by a max-limit of 100M. max-limit 20M would forbid borrowing; limit-at 100M per room is impossible to keep.

Next, you will let a client go faster than its max-limit for a few seconds, so web pages feel instant: burst.