====== General description of policing ======
{{indexmenu_n>1}}

{{ :en:dpi:dpi_options:opt_shaping:shaping_description:policing.png?nolink&700 |}}

SSG applies policing to the following logical objects:
  - Common Channel - All traffic passing through the DPI device that is not allocated to a Virtual Channel (vChannel). [[en:dpi:dpi_options:opt_shaping:shaping_settings|]].
  - Virtual channel (vChannel) - Traffic that is described by a physical port pair or VLAN or CIDR. This traffic is not included in the Common Channel and has its own configuration [[en:dpi:dpi_options:opt_shaping:shaping_multi|]].
  - Subscriber - The traffic of a particular Subscriber, which is defined by a list of IP addresses or CIDRs. Subscriber traffic can be assigned [[en:dpi:dpi_options:opt_bandwidth_mgmt|]], but also policing of the Shared or Virtual channel the Subscriber is on.
  - Session - Traffic that is defined by a set of parameters IPsrc:port, IPdst:port and protocol trait TCP, UDP, ICMP etc. [[en:dpi:dpi_options:opt_shaping:shaping_session|]]  

Policing is applied to the 8 traffic classes exposed by the option [[en:dpi:dpi_options:opt_priority|]]
<note important>Getting a protocol into its own class is also governed by the ([[dpi:dpi_options:opt_priority:dscp_table|class <-> priority]] option).
This approach allows the use of external and internal policers to be combined in a compatible manner. 
</note>

Two polishing mechanisms are available to choose from:
  - TBF without hierarchy ([[https://en.wikipedia.org/wiki/Token_bucket|Token Bucket Function]]), used to restrict/block a specific policing class. Band restriction with burst support. 
  - HTB with hierarchy for 8 classes ([[http://www.opennet.ru/base/net/htb_manual.txt.html|Hierarchical Token Bucket]]), used to prioritize by traffic class. Bandwidth limitation with borrowing.


Application scenarios of Shared and Virtual Channel Policing:
  - control the approach to the upper limit of the channel band ("shelf") and prioritize traffic by protocol and direction, so that low-priority traffic is displaced from the band in favor of high-priority traffic. This mechanism allows you to keep the shelf under control and save on the fact that you do not need to buy excess bandwidth, you can even lower the upper limit by 10-15% without any noticeable effect for subscribers.  
  - limit the size of the occupied bandwidth for a group of protocols. A popular use case for this mechanism is to limit torrents. One possible use case is described in the document [[en:dpi:dpi_options:use_cases:opt_uplink|"Optimizing uplink channel"]]