How to Limit Network Bandwidth in Linux using the tc Command

The Problem of Bandwidth Hogs

If you are hosting multiple services on a single Linux server (such as an Nginx web server, a MySQL database, and a massive FTP file repository), a user downloading a massive file via FTP can easily saturate your entire 1 Gigabit network interface. When the network card reaches 100% capacity, the web server will stop responding to legitimate traffic, and the database might drop connections due to latency.

To ensure fair network distribution, you can use the Linux Traffic Control (tc) utility to artificially throttle the bandwidth of specific network interfaces, ensuring that no single service can monopolize the connection.

Understanding Traffic Control (tc)

The tc command is a deeply complex utility that interacts directly with the Linux kernel’s network scheduler. It allows you to create hierarchical queuing disciplines (qdiscs) to shape, delay, or drop packets.

Before you begin, you need to know the exact name of the network interface you want to throttle. Run ip a or ifconfig to find it. For this example, we will assume your primary ethernet interface is named eth0.

Step 1: Implementing a Basic Bandwidth Limit

If you want to place a hard cap on the entire server, restricting the eth0 interface so it cannot transmit data faster than 100 Megabits per second (Mbps), you can apply a Token Bucket Filter (TBF) queuing discipline.

Run the following command as root or using sudo:

sudo tc qdisc add dev eth0 root tbf rate 100mbit burst 32kbit latency 400ms

Breaking Down the Command:

• qdisc add dev eth0 root: Adds a new queuing discipline to the root of the eth0 device.
• tbf: Specifies the Token Bucket Filter algorithm (excellent for simple rate limiting).
• rate 100mbit: Sets the absolute maximum bandwidth threshold.
• burst 32kbit: The size of the bucket. This allows brief spikes of traffic above the limit before the throttle slams shut.
• latency 400ms: If packets arrive faster than the rate limit, they wait in a queue. If they wait longer than 400ms, they are dropped.

Step 2: Verifying the Rules

To confirm that your traffic control rules have been successfully applied to the network interface, run:

tc -s qdisc ls dev eth0

The terminal will output the current active rules, showing you how many packets have been sent and how many have been intentionally delayed or dropped by the TBF algorithm to enforce your bandwidth limit.

Step 3: Removing the Limits

If you have finished your testing or need to restore the server to its full Gigabit capacity, you must delete the custom queueing discipline, which will restore the default pfifo_fast queue.

sudo tc qdisc del dev eth0 root

The 100Mbps bandwidth cap will instantly vanish, and the server will return to transmitting data as fast as the physical hardware allows.