04 Mechanisms
Proxies
Application-level shaping inserts itself into a single protocol stream — which is both its limit and its advantage.
The selective middle
A proxy stands in the path between an application and the network, speaking the application's own protocol on both sides. When shaping happens at this layer, it is not packet-level throttling — it is rate-limiting applied to a stream the proxy has already decoded. An HTTP proxy can slow a single origin, a single content type, or a single user-agent while leaving everything else untouched. That selectivity is something a kernel queue discipline cannot easily reach.
The practical consequence is granularity. A developer testing how a web client behaves when added latency is applied to requests might want to degrade only API calls, not the CDN assets, or vice versa. A proxy makes that cut; a shaper sitting beneath the network stack sees only IP packets and cannot distinguish one HTTP conversation's purpose from another.
The cost of that granularity is scope. A proxy only sees what it is asked to forward. Traffic that bypasses it — another process connecting directly, a second network interface, anything tunnelled in a protocol the proxy does not speak — is invisible. This is why shaping inside the kernel covers a machine completely while a proxy covers only what you route through it.
Application-level shaping also introduces its own queues. When a proxy holds bytes back to honour a rate limit, it is buffering in userspace. That buffer is outside the kernel's queue management; active queue management disciplines such as CoDel and FQ-CoDel, which operate on the kernel's transmit queues, have no visibility into it. The proxy's buffer can become a hidden latency source in its own right — and because it operates above the transport layer, it cannot signal congestion back to a TCP sender the way a dropping queue would.
CONNECT tunnelling and SOCKS proxies sit at a slightly lower rung: they forward TCP connections without interpreting the payload, which means they can shape at the connection level but cannot filter by content. They share the same blind-spot problem — traffic that does not go through them does not exist as far as they are concerned.
What a proxy does better than any other shaping point is target a single application's behaviour with protocol awareness. For testing whether a mobile client handles a slow image response gracefully, or whether a login form times out correctly under a degraded API, that precision is the whole point. The incompleteness is the trade-off: selective by design, blind by the same design.
