Policing

If a selector matches a given packet, a rate-based policing decision can be made in addition to this. The construct that describes an average rate limit or a double leaky bucket, begins with the keyword police, followed by parameters. Optionally one or both of the following items can follow: the action to take if the packet is found to exceed the constraints, and the keyword else and the action to take in the opposite case.

The following actions are possible:

pass

accept the packet (default in non-exceed case)

reclassify

put the packet in an inferior class (default in exceed case)

drop

drop the packet

continue

ignore this match and continue with the next selector

Examples:

  on (0x2e)
    police (rate 100kbps, burst 2kB, mtu 1.5kB);

  on (0x2e)
    police (rate 100kbps, burst 2kB, mtu 1.5kB) drop else continue;