Traffic shaping

Traffic shaping regulates how fast traffic leaves an interface. When a flow sends faster than its configured rate, the shaper holds the excess packets in a queue and releases them at the permitted pace, commonly using a token bucket to decide how much may pass at once. The effect is to smooth bursts into a steady stream. The ISC2 exam outline lists traffic flow and shaping under monitoring and management in Domain 4.

Shaping is often confused with policing. A policer enforces the same kind of rate limit but drops or re-marks the excess instead of delaying it. Shaping therefore adds latency and can add jitter but loses fewer packets, while policing keeps delay low at the cost of discarded traffic. Both are tools of quality of service, which classifies traffic so that sensitive flows such as voice over IP are protected when bandwidth is scarce. For security, shaping supports availability by stopping one flow starving the rest, but it has limits against a volumetric denial-of-service attack: if the flood fills the inbound link upstream, local shaping cannot win back that capacity.

Exam relevance: a scenario may describe queuing traffic to fit a rate, or protecting call quality on a congested link. Candidates are expected to tell shaping (delay the excess) apart from policing (drop the excess).