Shape an Internet Link with tc-cake

tc-cake shapes an interface with CAKE, the all-in-one Linux queueing discipline, and reports live stats once it's running. Budget about fifteen minutes for a first test, using iproute2 6.1.0-1ubuntu6.4, the version installed here.

You need the iproute2 package, the interface name, and a bandwidth figure a little below the real bottleneck rate. Checking and inspecting is ordinary user work. Changing a root qdisc needs elevated privileges and briefly touches live traffic.

1. Check the installed command

Confirm the binary and the package version before copying anyone else's configuration. None of this touches networking:

$ command -v tc
/usr/sbin/tc
$ tc -V
tc utility, iproute2-6.1.0
$ dpkg-query -W -f='${Package} ${Version}\n' iproute2
iproute2 6.1.0-1ubuntu6.4

The local tc-cake(8) page describes CAKE as a shaping-capable qdisc that bundles active queue management, flow isolation and optional Diffserv tins in one place. Every setting is optional, but a real internet configuration almost always sets bandwidth.

2. Identify the interface and current qdisc

Swap IFACE for the interface actually carrying the traffic you want to shape.

• Don't guess from the name. The first Ethernet-looking device isn't always the WAN interface, especially with bridges, containers or multiple uplinks.
• List the links, then pick one. Run the commands below and record the output before you touch anything, it's your recovery reference.

$ ip -br link
$ IFACE='eth0'
$ tc -s qdisc show dev "$IFACE"

The output may list several qdiscs. Whichever line is marked root is the one CAKE replaces in the next step.

3. Choose the rate and link correction

CAKE's bandwidth value sets its shaper. Use a measured rate below the service's sustainable bottleneck, never the headline package speed advertised by your ISP.

• Variable links get autorate. On a cellular connection the manpage offers autorate-ingress: it estimates capacity from traffic arriving at the qdisc and can't see anything downstream of itself.
• Overhead matters. The packet size Linux sees is not always the number of bytes metered on the wire, so the manpage supplies keywords for common technologies. ethernet covers Ethernet framing and equals overhead 38 mpu 84 noatm.
• ADSL and VDSL have their own keywords. An ADSL PPPoE connection may need pppoe-llcsnap or pppoe-vcmux; VDSL2 PPPoE may need pppoe-ptm, whichever matches your provider's framing.
• Check the modem, don't guess. If you don't know the link technology, start with a verified rate and the default raw accounting, then measure and refine.

The default RTT tuning is internet, equal to 100 ms, which is the sensible starting point for ordinary internet traffic. Don't use lan here, it's meant for a different kind of path entirely.

4. Apply a first CAKE configuration

This example shapes egress on an Ethernet bottleneck at 100 Mbit/s. The shell variable is just a convenience, so check it before running the privileged command:

$ printf 'interface: %s\n' "$IFACE"
interface: eth0
$ sudo tc qdisc replace dev "$IFACE" root cake bandwidth 100Mbit ethernet

This uses CAKE's documented defaults for Diffserv, flow isolation, RTT and GSO splitting, plus the explicit ethernet keyword for the link correction. CAKE's default shaper is unlimited, so leaving out bandwidth would not shape the link at all.

For a downstream internet link on a router, the qdisc has to sit where the router controls packets before they leave towards the LAN. Shaping inbound traffic usually needs an IFB or another topology-specific setup, well beyond this simple root-qdisc example. The ingress option changes CAKE's direction setting, it does not move the qdisc to a different interface on its own.

5. Verify the active settings

Ask tc for statistics straight after applying the change:

$ sudo tc -s qdisc show dev "$IFACE"
qdisc cake 1: root refcnt 2 bandwidth 100Mbit diffserv3 triple-isolate rtt 100.0ms noatm overhead 38 mpu 84
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
 memory used: 0b of 5000000b
 capacity estimate: 100Mbit

Your counters and handle will differ. What matters is that the root line says cake, the bandwidth matches your chosen value, and the overhead and RTT figures are what you expect. The manpage's own sample also shows per-tin counters for Bulk, Best Effort and Voice under the default diffserv3 preset.

Generate ordinary traffic, then run tc -s qdisc show again. overlimits tells you the shaper is actually kicking in, while dropped, backlog and the per-tin delay fields describe what the queue is experiencing. Zero counters straight after configuration are normal, they don't by themselves prove the rate or interface is right.

6. Adjust one assumption at a time

If the link still queues elsewhere, lower the CAKE rate slightly and test again. If throughput sits stubbornly below expectation despite a good rate, look harder at the real framing and add the matching overhead keyword. This changes only the rate, keeping Ethernet correction:

$ sudo tc qdisc replace dev "$IFACE" root cake bandwidth 95Mbit ethernet
$ sudo tc -s qdisc show dev "$IFACE"

For mostly local traffic, pick the RTT preset that matches the path: metro is 10 ms, regional is 30 ms. The manpage warns that lan, equal to 1 ms, can flag congestion prematurely on an ordinary Linux box. Only change RTT when the traffic pattern actually justifies it.

Leave diffserv3 and triple-isolate alone unless you have a specific reason to classify traffic differently. besteffort drops the priority tins entirely. dual-srchost shares an egress link fairly between source hosts; dual-dsthost suits an ingress path instead; triple-isolate is the sane general default. None of these choices change the physical capacity of the link, only how fairly it's shared.

7. Remove the test configuration

If the test causes trouble, pull the root qdisc with the documented deletion form:

$ sudo tc qdisc delete root dev "$IFACE"
$ sudo tc -s qdisc show dev "$IFACE"