Techzone/Bursty Traffic is Converted into Uniform Traffic by Leaky Bucket

Bursty Traffic is Converted into Uniform Traffic by Leaky Bucket

4 min readArticle

The most important practical effect of the leaky bucket algorithm: whatever pattern of traffic arrives (bursty, periodic, random), the output is always a smooth, uniform stream at the configured rate. Bursty in, uniform out.

What "Bursty" Means in Practice

Real network traffic is almost never uniform. Applications generate bursts:

  • HTTP/3 sends a full page's worth of resources in a burst when you load a URL
  • Backup jobs flood the network at start, then idle
  • Video streaming sends in chunks between buffering periods
  • Database queries hit in waves during business hours

This burstiness is efficient for the application but harmful to network equipment — routers, switches, and links get momentarily overloaded, causing drops and queuing delay.

The Conversion Mechanism

shell 
Bursty Input:   |####|   |######|  |##|      |#######|
                t=0  t=1  t=2   t=3 t=4 t=5  t=6

Leaky Bucket:   Buffer absorbs bursts, drains constantly

Uniform Output: |#|#|#|#|#|#|#|#|#|#|#|#|#|#|#|#|#|#|
                (constant spacing, constant rate)

The bucket buffers excess arrival. When a burst arrives, packets queue up in the bucket. The bucket drains at rate R — outputting one packet at fixed intervals (1/R seconds apart). The result: packets exit at exactly R pps regardless of how they arrived.

Comparison: Leaky Bucket vs Token Bucket

This is the critical distinction:

shell 
Scenario: 1000 packets arrive at t=0, then nothing for 10 seconds
Configured rate R = 100 pkt/s, bucket depth B = 500 pkt

Leaky Bucket:
  - 500 packets queued, 500 dropped immediately (bucket overflow)
  - Output: 100 pkt/s for exactly 5 seconds, then silence
  - UNIFORM — no burst in the output

Token Bucket (same rate, bucket depth 500 tokens):
  - 500 tokens available → 500 packets sent immediately (full burst)
  - Next 500 packets dropped OR wait for tokens
  - Output: burst of 500, then silence, then token accumulation
  - ALLOWS BURST — output mirrors input burst (up to token limit)

Leaky bucket = traffic shaping (smooth output) Token bucket = rate limiting with burst tolerance

Why ISPs and Routers Use It

ISPs use leaky bucket (and its variants) to:

  1. Police customer traffic — enforce contracted bandwidth, drop overages
  2. Protect downstream links — prevent a single customer's burst from filling shared link queues
  3. Ensure fair sharing — uniform output makes scheduling easier and prevents one flow from starving others
  4. Reduce jitter — VoIP and video conferencing need consistent inter-packet timing; leaky bucket eliminates jitter caused by bursty input

Token Bucket Advantage (Why Token Bucket Often Wins)

The leaky bucket's strict uniformity is too aggressive for many applications:

  • TCP needs to send burst acknowledgements
  • HTTP/2 server push relies on bursting initial data
  • Video streaming needs to send a burst to fill the client buffer

Token bucket accommodates these by allowing a burst up to the token reservoir depth, then falling back to rate R. Most modern rate limiters are token bucket or variants (like dual-rate three-color marking).

Linux Implementation — Seeing the Conversion

bash 
# Set up leaky-bucket-style shaping on a loopback test
# Rate: 1Mbit, burst: 1500 bytes (one packet), latency 100ms
sudo tc qdisc add dev lo root tbf rate 1mbit burst 1500 latency 100ms

# Send bursty traffic with hping3 (100 packets as fast as possible)
hping3 -c 100 --fast 127.0.0.1

# Check tc stats — see how packets are queued and sent uniformly
tc -s qdisc show dev lo
# sent X bytes Y pkt (overlimits Z) (backlog Ybytes Ypkts)
# 'overlimits' = overflow events (drops)

# Remove shaping
sudo tc qdisc del dev lo root

Real-World Observation: tcpdump Before and After

bash 
# Without shaping — see burst pattern in inter-packet timing
tcpdump -i eth0 -ttt | head -50
# Time deltas between packets: 0.000012, 0.000009, 0.000010 (tight burst)

# With leaky bucket shaping at 1Mbit
sudo tc qdisc add dev eth0 root tbf rate 1mbit burst 1500 latency 50ms

# Now check timing
tcpdump -i eth0 -ttt | head -50
# Time deltas: 0.001200, 0.001199, 0.001201 (uniform ~1.2ms spacing)
# 1Mbit / (1500 bytes * 8 bits) = 1,000,000 / 12,000 = ~83 pkt/s → 12ms spacing

Reference

  • RFC 2697 — Single Rate Three Color Marker
  • RFC 4115 — Two-Rate Three-Color Marker (combines leaky + token bucket)
  • Linux tc-tbf: man tc-tbf
  • "Computer Networks" Tanenbaum — Section 5.4 (Traffic Shaping)
techzonesite.comUnlock Your IT Potential