Tuning and troubleshooting

Link-layer overhead

CAKE counts bytes as the kernel sees them, but the line carries extra headers the kernel never sees: PPPoE, ATM cells on ADSL, DOCSIS framing on cable. With small packets (calls, games, ACKs) that overhead is a big share, so a shaper that ignores it overruns the line. CAKE has keywords for common links: docsis for cable, pppoe-ptm or bridged-ptm for VDSL2, pppoe-vcmux and friends for ADSL, ethernet for fibre handed over as Ethernet. Add the one for your line (cake bandwidth 18mbit ingress dual-dsthost docsis). The lab's virtual links have no such overhead, so it uses raw, the default.

DiffServ

CAKE's tins only help traffic that's marked. Phones and conferencing systems often set DSCP EF (voice) on their packets; many PCs and ISPs don't, or strip the markings. diffserv3 (the default) is a sensible choice; besteffort turns tins off if you don't trust the markings on your network; wash clears markings on the way out if your ISP misbehaves with them.

Troubleshooting

Symptom	Check	Usual cause
Loaded latency still high	tc -s qdisc show dev ens4: is CAKE there, and dropping?	Bandwidth set at or above the real line speed: lower it
Speed much lower than expected	The bandwidth setting; CPU load on the router	Set too low; or the router's CPU can't keep up (CAKE is cheap, but every packet is touched)
Downloads still bufferbloated, uploads fine	tc qdisc show dev ifb4ens4; tc filter show dev ens4 ingress	No IFB or no redirect filter, or the ingress bandwidth too close to the line
One PC still hogs the line	The isolation mode in tc qdisc show	triple-isolate or flows instead of dual-srchost/dual-dsthost; behind NAT, the nat keyword missing
Shaping gone after a reboot	networkctl status ens4; systemctl status cake-ingress	No [CAKE] section, or the service not enabled
Error: Specified qdisc kind is unknown.	modinfo sch_cake	A kernel without CAKE: a container, or a cut-down kernel. Debian's own kernel has it

Cheat sheets: nftables, Network error messages explained.