Manual:Queue

Queues

Submenu level: /queue

Queues are used to limit and prioritize traffic. They can be used to

• limit data rate for certain IP addresses, subnets, protocols, ports, and other parameters
• limit peer-to-peer traffic
• prioritize some packet flows over others
• configure traffic bursts for faster web browsing
• apply different limits based on time
• share available traffic among users equally, or depending on the load of the channel

Queue implementation in MikroTik RouterOS is based on Hierarchical Token Bucket (HTB). HTB allows to create hierarchical queue structure and determine relations between queues.

In RouterOS, these hierarchical structures can be attached at 4 different places:

• global-in: represents all the input interfaces in general (INGRESS queue). Queues attached to global-in apply to traffic that is received by the router before the packet filtering
• global-out: represents all the output interfaces in general (EGRESS queue).
• global-total: represents all input and output interfaces together (in other words it is aggregation of global-in and global-out). Used in case when customers have single limit for both, upload and download.
• <interface name>: - represents one particular outgoing interface. Only traffic that is designated to go out via this interface will pass this HTB queue.

There are two different ways how to configure queues in RouterOS:

• /queue simple menu - designed to ease configuration of simple, everyday queuing tasks (such as single client upload/download limitation, p2p traffic limitation, etc.).
• /queue tree menu - for implementing advanced queuing tasks (such as global prioritization policy, user group limitations). Requires marked packet flows from /ip firewall mangle facility.

Simple Queues

Submenu level: /queue simple

One simple queue can stand for up to 3 separate queues - one queue in global-in, one queue in global-out and one queue in global-total. But these queues will be created only if at least one option is different from the defaults (in another words queues without limits, childs and with queue type default-small will not be activated). This way creation of global-total queues can be avoided if only upload/download limitation is used or other way around.

Simple queues have strict order - each packet must go through every queue until it will meet conditions. (In case of 1000 queues, packet for last queue will need to proceed through 999 queues before it will reach the destination)

Flow Identifiers

• target-addresses (multiple choice: IP address/netmask) : list of IP address ranges that will be limited by this queue.
• interface (Name of the interface, or all) : identifies interface the target is connected to. Useful when it is not possible to specify targets addresses.

Each of these two properties can be used to determine which direction is target upload and which is download.

Be careful to configure both of these options for the same queue - in case they will point to opposite directions queue will not work.

If neither value of target-addresses nor of interface is specified, the queue will not be able to make difference between upload and download, and will limit all traffic twice.

Other properties

• name (Text) : Unique queue identifier that can be used as parent option value for other queues
• direction (One of both, upload, download, none; default: both) : allow to enable one-directional limitation for simple queues (disable other direction)
  • both - limit both download and upload traffic
  • upload - limit only traffic to the target
  • download - limit only traffic from the target
• time (TIME-TIME,sun,mon,tue,wed,thu,fri,sat - TIME is local time, all day names are optional; default: not set) : allow to specify time when particular queue will be active. Router must have correct time settings.
• dst-address (IP address/netmask) : allows to select only specific stream (from target address to this destination address) for limitation
• p2p (one of all-p2p, bit-torrent, blubster, direct-connect, edonkey, fasttrack, gnutella, soulseek, winmx; default: not set) : allow to select unencrypted packets of particular p2p for limitation
• packet-marks (Comma separated list of packet mark names) : allows to use marked packets from /ip firewall mangle. Take look at this packet flow diagram. It is necessary to make sure that packets are marked before the simple queues (before global-in HTB queue) or else targets download limitation will not work - only mangle chain before global-in is prerouting

HTB Properties

• parent (Name of , or none) : assigns this queue as a child queue for selected target. Target queue can be HTB queue or any other previously created simple queue. In order for traffic to reach child queues, parent queues must capture all necessary traffic.
• priority (1..8) : Prioritize one child queue over other child queue. Does not work on parent queues (if queue has at least one child). One is the highest, eight is the lowest priority. Child queue with higher priority will have chance to reach its limit-at before child with lower priority and after that child queue with higher priority will have chance to reach its max-limit before child with lower priority. Priority have nothing to do with bursts.
• queue (SOMETHING/SOMETHING) : Choose the type of the upload/download queue. Queue types can be created here
• limit-at (NUMBER/NUMBER) : normal upload/download data rate that is guaranteed to a target
• max-limit (NUMBER/NUMBER) : maximal upload/download data rate that is allowed for a target to reach
• burst-limit (NUMBER/NUMBER) : maximal upload/download data rate which can be reached while the burst is active
• burst-time (TIME/TIME) : period of time, in seconds, over which the average upload/download data rate is calculated. (This is NOT the time of actual burst)
• burst-threshold (NUMBER/NUMBER) : when average data rate is below this value - burst is allowed, as soon as average data rate reach this value - burst is denied. (basically this is burst on/off switch). For optimal burst behavior this value should above limit-at value and below max-limit value

And corresponding options for global-total HTB queue:

• total-queue (SOMETHING/SOMETHING): corresponds to queue only for global-total queue
• total-limit-at (NUMBER/NUMBER): corresponds to limit-at only for global-total queue
• total-max-limit (NUMBER/NUMBER): corresponds to max-limit only for global-total queue
• total-burst-limit (NUMBER/NUMBER): corresponds to burst-limit only for global-total queue
• total-burst-time (TIME/TIME): corresponds to burst-time only for global-total queue
• total-burst-threshold (NUMBER/NUMBER): corresponds to burst-threshold only for global-total queue

Good practice suggest that:

Sum of child's limit-ats must be less or equal to max-limit of the parent.

Every child's max-limit must be less than max-limit of the parent - this way you will leave some traffic for other child queues - they will be able to get traffic without fighting it of the other child queue.

Statistics

• rate (read-only/read-only) : average queue passing data rate in bytes per second
• packet-rate (read-only/read-only) : average queue passing data rate in packets per second
• bytes (read-only/read-only) : number of bytes processed by this queue
• packets (read-only/read-only) : number of packets processed by this queue
• queued-bytes (read-only/read-only) : number of bytes waiting in the queue
• queued-packets (read-only/read-only) : number of packets waiting in the queue
• dropped (read-only/read-only) : number of dropped packets
• borrows (read-only/read-only) : packets that passed queue over its "limit-at" value (and was unused and taken away from other queues)
• lends (read-only/read-only) : packets that passed queue below its "limit-at" value OR if queue is a parent - sum of all child borrowed packets
• pcq-queues (read-only/read-only) : number of PCQ substreams, if queue type is PCQ

And corresponding options for global-total HTB queue:

• total-rate (read-only): corresponds to rate only for global-total queue
• total-packet-rate (read-only): corresponds to packet-rate only for global-total queue
• total-bytes (read-only): corresponds to bytes only for global-total queue
• total-packets (read-only): corresponds to packets only for global-total queue
• total-queued-bytes (read-only): corresponds to queued-bytes only for global-total queue
• total-queued-packets (read-only): corresponds to queued-packets only for global-total queue
• total-dropped (read-only): corresponds to dropped only for global-total queue
• total-lends (read-only): corresponds to lends only for global-total queue
• total-borrows (read-only): corresponds to borrows only for global-total queue
• total-pcq-queues (read-only): corresponds to pcq-queues only for global-total queue

Queue Tree

Submenu level: /queue tree

Queue tree creates only one directional queue in one of the HTBs. It is also the only way how to add queue on the separate interface. This way it is possible to ease mangle configuration - you don't need separate marks for download and upload - only upload will get to private interface and only download will get to Public interface.

Also it is possible to have double queuing (example:prioritization of traffic in global-in or global-out, limitation per client on the outgoing interface) If you have simple queues and queue tree in the same HTB - simple queues will get traffic first.

Queue tree is not ordered - all traffic pass it together.

Flow Identifiers

• name (Text) : Unique queue identifier that can be used as parent option value for other queues
• packet-marks (Comma separated list of) : allows to use marked packets from /ip firewall mangle. Take look at this packet flow diagram. You need to make sure that packets are marked before the simple queues (before global-in HTB queue)

HTB Properties

• parent (Name of , or none) : assigns this queue as a child queue for selected target. Target queue can be HTB queue or any other previously created queue
• priority (1..8) : Prioritize one child queue over other child queue. Does not work on parent queues (if queue has at least one child). One is the highest, eight is the lowest priority. Child queue with higher priority will have chance to reach its limit-at before child with lower priority and after that child queue with higher priority will have chance to reach its max-limit before child with lower priority. Priority have nothing to do with bursts.
• queue (SOMETHING) : Choose the type of the queue. Queue types can be created here
• limit-at (NUMBER) : normal data rate that is guaranteed to a target
• max-limit (NUMBER) : maximal data rate that is allowed for a target to reach
• burst-limit (NUMBER) : maximal data rate which can be reached while the burst is active
• burst-time (TIME) : period of time, in seconds, over which the average data rate is calculated. (This is NOT the time of actual burst)
• burst-threshold (NUMBER) : when average data rate is below this value - burst is allowed, as soon as average data rate reach this value - burst is denied. (basically this is burst on/off switch). For optimal burst behavior this value should above limit-at value and below max-limit value

Statistics

• rate (read-only) : average queue passing data rate in bytes per second
• packet-rate (read-only) : average queue passing data rate in packets per second
• bytes (read-only) : number of bytes processed by this queue
• packets (read-only) : number of packets processed by this queue
• queued-bytes (read-only) : number of bytes waiting in the queue
• queued-packets (read-only) : number of packets waiting in the queue
• dropped (read-only) : number of dropped packets
• borrows (read-only) : packets that passed queue over its "limit-at" value (and was unused and taken away from other queues)
• lends (read-only) : packets that passed queue below its "limit-at" value OR if queue is a parent - sum of all child borrowed packets
• pcq-queues (read-only) : number of PCQ substreams, if queue type is PCQ

Queue Types

Submenu level: /queue type

• name (Text) : Unique queue identifier that can be used in simple queues and queue tree as value of queue option
• kind (bfifo | pcq | pfifo | red | sfq) : kind of particular queue type

PFIFO and BFIFO

These queuing disciplines are based on the FIFO algorithm (First-In First-Out). The difference between PFIFO and BFIFO is that one is measured in packets and the other one in bytes.

• pfifo-limit (number) : Maximum number of packets that the PFIFO queue can hold
• bfifo-limit (number) : Maximum number of bytes that the BFIFO queue can hold

Every packet that cannot be enqueued (if the queue is full), is dropped. Large queue sizes can increase latency, but utilize channel better.

RED

Random Early Drop is a queuing mechanism which tries to avoid network congestion by controlling the average queue size. When the average queue size reaches red-min-threshold, RED starts to drop packets randomly with linearly increasing probability as the average queue size grows up until the average queue size reaches the red-max-threshold. The effective queue size at any moment could be higher than the red-max-threshold as the probability does not grow very fast, so it is possible to specify a hard limit for the queue size. When the average queue size reaches red-max-threshold or becomes larger, all further packets are dropped until the average queue size does not drop below this values (at which point probabilistic calculations will be activated again).

• red-avg-packet (number) : Used by RED for average queue size calculations (for packet to byte translation)
• red-burst (number) : Number of packets allowed for bursts of packets when there are no packets in the queue
• red-limit(number) : RED queue limit in packets
• red-max-threshold (number) : The average queue size at which packet marking probability is the highest
• red-min-threshold (number) : Average queue size in bytes

SFQ

Stochastic Fairness Queuing (SFQ) is ensured by hashing and round-robin algorithms. A traffic flow may be uniquely identified by a 4 options(src-address, dst-address, src-port and dst-port), so these parameters are used by SFQ hashing algorithm to classify packets into one of 1024 possible subqueues. Then round-robin algorithm will start to distribute available bandwidth to all subqueues, on each round giving sfq-allot bytes of traffic. The whole SFQ queue can contain 128 packets and there are 1024 subqueues available.

• sfq-allot (number) : How often hash function must be refreshed
• sfq-perturb (time) : Amount of data in bytes that can be sent in one round-robin round

PCQ

Per Connection Queuing (PCQ) is a similar to SFQ, but it has addicional features.

It is possible to choose flow identifiers (from dst-address | dst-port | src-address | src-port). For example if you classify flows by src-address on local interface (interface with your clients), each PCQ subqueue will be one particular client's upload.

It is possible to assign speed limitation to subqueues with pcq-rate option. If pcq-rate=0 subqueues will divide available traffic equally.

• pcq-classifier (dst-address | dst-port | src-address | src-port; default: "")  : selection of subqueue identifiers
• pcq-rate (number) : maximal available data rate of each subqueue
• pcq-limit (number) : queue size of one subqueue in packets
• pcq-total-limit (number) : queue size of all PCQ in packets

Interface Queue

Submenu level: /queue interface

• interface(SOMETHING) : name of interface
• queue (something) : queue type assigned to particular interface