Traffic policing and traffic shaping both limit bandwidth utilization, and both use a token bucket. Traffic policing is used to slow down traffic to a value that the medium can support, to monitor bandwidth utilization, to enforce bandwidth limitations at the service provider edge, and to remark traffic that exceeds the Service Level Agreement (SLA). Traffic shaping is used to slow down traffic due to congestion, to enforce bandwidth rates, and to send traffic classes at different rates.

To control the rate at which an interface sends packets, traffic policing and traffic shaping use a token bucket. Tokens are put into the token bucket at a specified rate, and tokens are removed from the bucket as bits are sent through the interface. If there are not enough tokens to send a packet, traffic policing drops or remarks the packet. As a result, traffic policing can cause traffic to be bursty. By contrast, traffic shaping queues packets when there are not enough tokens to send them. This generates a "leaky bucket" effect, which smooths traffic into a constant flow rather than a variable, bursty flow. The shaping parameters can also be configured so that packets can be sent in excess of the committed information rate (CIR) for a short period of time.

Traffic shaping does not remark excess traffic. Instead, traffic shaping buffers excess traffic and out-of-profile packets in memory until the queue is full and drops traffic only if the queue is full. By contrast, traffic policing drops or remarks excess traffic and out-of-profile packets.