[c-nsp] policy-map on 2950 problem

[jan gregor]

Hello list.

I'm having troubles setting policers on our edge switches, which are all
Catalysts 2950 running EI. The problem is, that I need to limit input on
ports to 5Mb/s and the traffic going there is one TCP session (scp
namely). Even with rate of 5000000 and burst 65536 I was not able to get
more than 2144 kb/s in that session.

The policer settings I have tried:
access-list 1 permit any

class-map match-all ipclass1
  match access-group 1

policy-map 2mb
  class ipclass1
    police 2000000 65536 exceed-action drop
policy-map 1mb
  class ipclass1
    police 1000000 32768 exceed-action drop
policy-map 5mb-max
  class ipclass1
    police 5000000 65536 exceed-action drop
policy-map 2mb-max
  class ipclass1
    police 2000000 65536 exceed-action drop
policy-map 3mb-max
  class ipclass1
    police 3000000 65536 exceed-action drop
policy-map 1mb-max
  class ipclass1
    police 1000000 65536 exceed-action drop
policy-map 1mb-min
  class ipclass1
    police 1000000 4096 exceed-action drop
policy-map 2mb-min
  class ipclass1
    police 2000000 4096 exceed-action drop
policy-map 3mb-min
  class ipclass1
    police 3000000 4096 exceed-action drop
policy-map 5mb-min
  class ipclass1
    police 5000000 4096 exceed-action drop

And traffic rates were:
policy-map	upload (scp)
1mb-min		16.2KB/s
1mb-max		117.3KB/s
2mb-min		16.3KB/s
2mb-max		237.2KB/s
3mb-min		16.8KB/s
3mb-max		259.5KB/s
5mb-min		16.9KB/s
5mb-max		267.7KB/s
no policy-map	8.0MB/s
1mb		116.9KB/s
2mb		238.2KB/s

Can someone give me a clue on what I'm doing wrong here? 


Many thanks.

Jan Gregor