Downloads: CAKE on an IFB

Downloads are harder. By the time packets reach the router, they've already crossed the slow line, so the queue that hurts is in the ISP's equipment, before the line. A router can't shape what it hasn't received yet. What it can do is drop and delay incoming traffic slightly below the line's speed, so TCP senders on the internet slow down and the ISP's queue stays empty.

Linux only queues traffic on the way out of an interface, so incoming traffic needs a trick: redirect it to an IFB (Intermediate Functional Block), a virtual interface whose only job is to have an outgoing queue.

1. Create the IFB device, ifb4ens4, and bring it up.
2. Add an ingress qdisc to the WAN interface, and a filter that redirects everything arriving there to the IFB.
3. Put CAKE on the IFB, with ingress mode, at about 90% of the download speed: 18 Mbit/s.

During a full download, the average ping falls from 400 ms to 0.64 ms, and the download runs at 17.0 instead of 19.1 Mbit/s.

The ingress keyword matters: it tells CAKE that the bandwidth limit applies to packets already received, so it counts the packets it drops against the limit too, which keeps the effective rate right. Ingress shaping needs a bigger margin than egress, because the router reacts one step late; if loaded latency creeps up during downloads, lower its bandwidth first.

root@gw:~# ip link add ifb4ens4 type ifb && ip link set ifb4ens4 up && tc qdisc add dev ens4 handle ffff: ingress && tc filter add dev ens4 parent ffff: matchall action mirred egress redirect dev ifb4ens4 && tc qdisc add dev ifb4ens4 root cake bandwidth 18mbit ingress && tc qdisc show dev ifb4ens4
qdisc cake 8002: root refcnt 2 bandwidth 18Mbit diffserv3 triple-isolate nonat nowash ingress no-ack-filter split-gso rtt 100ms raw overhead 0 

root@client:~# iperf3 -c 198.51.100.10 -t 20 -R > /tmp/down.txt & sleep 3; ping -q -c 75 -i 0.2 198.51.100.10 | tail -2; wait; grep receiver /tmp/down.txt
75 packets transmitted, 75 received, 0% packet loss, time 15317ms
rtt min/avg/max/mdev = 0.202/0.638/1.279/0.252 ms
[  5]   0.00-20.01  sec  40.6 MBytes  17.0 Mbits/sec                  receiver