{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "item": { "id": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "slug": "decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client", "url": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client.md", "json": "https://update.dsesecurity.com/api/v1/posts/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/" }, "title": "Decide whether a pfSense limiter is shared or masked per client", "summary": "The same numeric limit can mean one shared bucket or many independent buckets.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:24+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 247, "potentially_affected": "This concerns pfSense dummynet limiters.", "dse_recommendation": "DSE recommends translating the requirement into either a total segment cap or an individual client cap before setting masks.", "primary_source": { "name": "Netgate — Limiters", "url": "https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The same numeric limit can mean one shared bucket or many independent buckets.

\n

Source facts

\n

Netgate explains that an unmasked limiter shares one bandwidth bucket across matching traffic. A source or destination mask creates separate buckets per host or network according to the mask. Limiters normally work in directional pairs. A limiter pipe has a hard upper limit and does not borrow bandwidth from another pipe.

\n

Source: Netgate — Limiters.

\n

Applicability

\n

This concerns pfSense dummynet limiters.

\n

DSE recommendation

\n

DSE recommends translating the requirement into either a total segment cap or an individual client cap before setting masks. Record which address is visible at the rule’s attachment point and how the upload and download directions map to the paired limiters. Consider aggregate demand when many independently masked clients are active. Avoid describing a sum of possible per-client limits as capacity the physical link can actually deliver. Have the bandwidth owner state whether the requirement is a shared site ceiling or an individual-client ceiling before approving the mask. Test two clients together and separately under the same proposed limit, and preserve both observations so the intended bucket scope is demonstrated.

\n

Verification

\n

Use two authorized test clients concurrently. Compare their combined rate under an unmasked design with the intended independent behavior under a masked design. Test both directions and inspect the relevant queues. Repeat with representative IPv4 and IPv6 rules where required, and record observed contention rather than treating the configured maximum as guaranteed throughput.

\n

Official reference

\n

Netgate — Limiters. Reviewed October 20, 2026.

", "content_text": "The same numeric limit can mean one shared bucket or many independent buckets.\nSource facts\nNetgate explains that an unmasked limiter shares one bandwidth bucket across matching traffic. A source or destination mask creates separate buckets per host or network according to the mask. Limiters normally work in directional pairs. A limiter pipe has a hard upper limit and does not borrow bandwidth from another pipe.\nSource: Netgate — Limiters.\nApplicability\nThis concerns pfSense dummynet limiters.\nDSE recommendation\nDSE recommends translating the requirement into either a total segment cap or an individual client cap before setting masks. Record which address is visible at the rule’s attachment point and how the upload and download directions map to the paired limiters. Consider aggregate demand when many independently masked clients are active. Avoid describing a sum of possible per-client limits as capacity the physical link can actually deliver. Have the bandwidth owner state whether the requirement is a shared site ceiling or an individual-client ceiling before approving the mask. Test two clients together and separately under the same proposed limit, and preserve both observations so the intended bucket scope is demonstrated.\nVerification\nUse two authorized test clients concurrently. Compare their combined rate under an unmasked design with the intended independent behavior under a masked design. Test both directions and inspect the relevant queues. Repeat with representative IPv4 and IPv6 rules where required, and record observed contention rather than treating the configured maximum as guaranteed throughput.\nOfficial reference\nNetgate — Limiters. Reviewed October 20, 2026.", "content_markdown": "The same numeric limit can mean one shared bucket or many independent buckets.\n\n## Source facts\n\nNetgate explains that an unmasked limiter shares one bandwidth bucket across matching traffic. A source or destination mask creates separate buckets per host or network according to the mask. Limiters normally work in directional pairs. A limiter pipe has a hard upper limit and does not borrow bandwidth from another pipe.\n\nSource: [Netgate — Limiters](https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html).\n\n## Applicability\n\nThis concerns pfSense dummynet limiters.\n\n## DSE recommendation\n\nDSE recommends translating the requirement into either a total segment cap or an individual client cap before setting masks. Record which address is visible at the rule’s attachment point and how the upload and download directions map to the paired limiters. Consider aggregate demand when many independently masked clients are active. Avoid describing a sum of possible per-client limits as capacity the physical link can actually deliver. Have the bandwidth owner state whether the requirement is a shared site ceiling or an individual-client ceiling before approving the mask. Test two clients together and separately under the same proposed limit, and preserve both observations so the intended bucket scope is demonstrated.\n\n## Verification\n\nUse two authorized test clients concurrently. Compare their combined rate under an unmasked design with the intended independent behavior under a masked design. Test both directions and inspect the relevant queues. Repeat with representative IPv4 and IPv6 rules where required, and record observed contention rather than treating the configured maximum as guaranteed throughput.\n\n## Official reference\n\n[Netgate — Limiters](https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "url": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Decide whether a pfSense limiter is shared or masked per client", "item": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/#article", "identifier": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "url": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/", "headline": "Decide whether a pfSense limiter is shared or masked per client", "description": "The same numeric limit can mean one shared bucket or many independent buckets.", "abstract": "The same numeric limit can mean one shared bucket or many independent buckets.", "articleBody": "The same numeric limit can mean one shared bucket or many independent buckets.\nSource facts\nNetgate explains that an unmasked limiter shares one bandwidth bucket across matching traffic. A source or destination mask creates separate buckets per host or network according to the mask. Limiters normally work in directional pairs. A limiter pipe has a hard upper limit and does not borrow bandwidth from another pipe.\nSource: Netgate — Limiters.\nApplicability\nThis concerns pfSense dummynet limiters.\nDSE recommendation\nDSE recommends translating the requirement into either a total segment cap or an individual client cap before setting masks. Record which address is visible at the rule’s attachment point and how the upload and download directions map to the paired limiters. Consider aggregate demand when many independently masked clients are active. Avoid describing a sum of possible per-client limits as capacity the physical link can actually deliver. Have the bandwidth owner state whether the requirement is a shared site ceiling or an individual-client ceiling before approving the mask. Test two clients together and separately under the same proposed limit, and preserve both observations so the intended bucket scope is demonstrated.\nVerification\nUse two authorized test clients concurrently. Compare their combined rate under an unmasked design with the intended independent behavior under a masked design. Test both directions and inspect the relevant queues. Repeat with representative IPv4 and IPv6 rules where required, and record observed contention rather than treating the configured maximum as guaranteed throughput.\nOfficial reference\nNetgate — Limiters. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:24+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/decide-whether-a-pfsense-limiter-is-shared-or-masked-per-client/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Decide whether a pfSense limiter is shared or masked per client" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 247, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Limiters", "url": "https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html" } } ] } }