What is WRED?

Understanding WRED

WRED (Weighted Random Early Detection) is a congestion-avoidance queue-management mechanism that selectively and randomly drops packets before a router's output queue fills, preventing buffer overflow and tail drop. The weighted aspect means higher-priority traffic (by DSCP or IP precedence) is dropped less aggressively than lower-priority traffic, integrating congestion control with Quality of Service.

WRED works by monitoring the average queue depth and applying drop probabilities based on configurable minimum and maximum thresholds per traffic class. Below the minimum threshold, no packets are dropped. Between the minimum and maximum, packets are dropped with a probability that rises as the queue grows. Above the maximum, packets are dropped outright. Because higher-priority classes are assigned higher thresholds, their packets survive longer under congestion. This selective early dropping signals TCP senders to slow down gradually, an improvement over plain Random Early Detection (RED) that adds class awareness.

WRED matters for network performance and, indirectly, security through availability. By dropping a few packets early and randomly, it avoids TCP global synchronization, the condition where many TCP flows all back off and ramp up in lockstep after a simultaneous tail-drop, causing inefficient bursts of congestion and underutilization. Smoothing this behavior keeps links efficient and protects high-priority traffic such as voice, video, and management sessions during congestion. In a denial-of-service or traffic-flood scenario, WRED's weighting helps preserve critical and control-plane traffic while best-effort traffic absorbs the drops.

For example, a WAN router carrying mixed enterprise traffic configures WRED so that EF-marked voice has high drop thresholds while best-effort bulk data has low ones. During a backup that saturates the link, WRED begins randomly dropping best-effort packets early, prompting those TCP sessions to throttle back. Voice traffic, with its higher thresholds, is largely untouched, so calls remain clear and the link avoids a hard congestion collapse.