ulearn/systems

topics / traffic-routing

Rate Limiter

Fixed window, sliding window, token bucket and leaky bucket throttling, keyed per client. Hammer one caller to see it kick in — then flood from thousands of spoofed IPs to see where per-client limiting alone stops helping.

New here? Hover any underlined word for a quick definition, orstart with Study →
0sent
0allowed
0limited (429)
0throttled (429 global)
0overloaded (503)
0blocked (never reaches app)
in flightallowedlimited (429)overloaded (503)attack trafficnetworkclientsRate limiterfixed window429 × 0Server limiterbypassedAPI200 × 0503 × 0held 0/20

Clients

10.0.0.25/5 left
0 allowed0 limited
10.0.0.35/5 left
0 allowed0 limited
10.0.0.45/5 left
0 allowed0 limited
10.0.0.55/5 left
0 allowed0 limited
10.0.0.65/5 left
0 allowed0 limited
10.0.0.75/5 left
0 allowed0 limited

Event log

Waiting for traffic…

Algorithm

Fixed window: Counts requests in a fixed-size time slot (e.g. per minute) and resets to zero when the window rolls over. Simple and cheap, but bursty right at the boundary — a client can send a full window's worth of requests right before a reset and another full window's worth right after.

Limiter config

Server-wide limiter

Traffic

Attack simulation

Pick an attack type. HTTP Flood and Slowloris are HTTP-layer floods this diagram can actually route; SYN Flood and UDP Amplification operate below the HTTP layer and never reach a rate limiter at all — watch them get intercepted at the network edge instead.