Tail drop vs WRED: what happens when a queue fills

When a network queue fills up, packets must be dropped. How that happens matters. Tail drop and WRED are two fundamentally different strategies for managing congestion, and choosing between them affects throughput, latency, and application behavior. Understanding the difference is essential for anyone designing QoS policies or preparing for network certification.

Tail drop: the simple approach

Tail drop is the default queue management behavior on most network devices. When a queue reaches its maximum size, every new arriving packet is discarded until queue depth falls below the limit. Packets that arrived first are served first; new packets simply do not enter the queue.

This sounds reasonable but creates a serious problem: when congestion occurs, many TCP flows simultaneously experience packet loss. They all interpret this as a signal to reduce their sending rate, then all attempt to recover at roughly the same time. This synchronized behavior is called TCP global synchronization, and it causes bursty traffic patterns that underutilize the link.

Tail drop behavior:

Queue fills to max depth
|
v
Next packet arrives
|
v
Queue is full -> packet dropped
|
v
Multiple TCP flows see loss simultaneously
|
v
All flows reduce window size
|
v
Link utilization drops sharply

WRED: probabilistic early drop

WRED (Weighted Random Early Detection) drops packets before the queue is completely full. It monitors average queue depth and begins randomly discarding packets when depth exceeds a lower threshold. As queue depth increases toward the maximum, the drop probability increases.

The key insight: by dropping packets early and randomly, WRED causes different TCP flows to experience loss at different times. This prevents global synchronization. Flows back off gradually and asynchronously, keeping the link more consistently utilized.

WRED can also be weighted by DSCP marking. Higher-priority traffic (lower drop probability) is protected while lower-priority traffic absorbs more drops. This allows QoS policies to work alongside congestion management.

WRED behavior:

Average queue depth monitored
|
v
Depth exceeds min-threshold
|
v
Random drops begin (low probability)
|
v
As depth approaches max-threshold
|
v
Drop probability increases
|
v
TCP flows experience loss at different times
|
v
Link stays better utilized

Practical comparison

• →Tail drop: simpler, no configuration needed, but causes traffic synchronization and link underutilization during congestion
• →WRED: requires tuning (min-threshold, max-threshold, drop probability), but smoother congestion response and better throughput
• →WRED with DSCP: enables differentiated drop behavior so priority traffic stays protected while best-effort traffic bears the cost
• →Tail drop suitable for: lightly congested networks or when all traffic is equally important
• →WRED suitable for: production networks with mixed traffic classes and predictable congestion periods

Configuration example

Most platforms allow you to enable WRED on an interface or policy-map. Here is a typical Cisco IOS approach:

policy-map WRED-POLICY
 class class-default
  random-detect
  random-detect dscp-based
  random-detect dscp 0 min-threshold 20 max-threshold 40
  random-detect dscp 24 min-threshold 40 max-threshold 60

interface GigabitEthernet0/0/1
 service-policy output WRED-POLICY

This enables WRED with DSCP-based drop profiles. DSCP 0 (best-effort) starts dropping at 20 packets and reaches maximum probability at 40. DSCP 24 (EF, expedited forwarding) is protected with higher thresholds.

When to use each

• →Use tail drop if: your network is rarely congested, or you need absolute simplicity and no tuning overhead
• →Use WRED if: you have mixed traffic classes, predictable congestion, or need to protect priority traffic while managing overall throughput
• →Combine with traffic shaping: WRED works best alongside rate limiting or traffic policing to prevent sustained overload

The choice between tail drop and WRED reflects your network's maturity. Simple networks tolerate tail drop. Production networks with QoS policies benefit from WRED's smoother congestion response and DSCP-aware drop behavior.