Den richtigen Algorithmus auswählen

You have studied fixed window counter, leaky bucket, and token bucket individually. Now the practical question: which one should you actually use? Each makes different trade-offs around bursts, smoothing, and cost.

Compare algorithms along a few axes:

• Burst tolerance: can clients spike briefly?
• Smoothing: is output traffic even?
• Memory cost: state per client.
• Fairness at boundaries.

Fixed window is the cheapest: one counter per window per client. Its flaw is the boundary burst: a client can send a full window of requests at the end of one window and another full window at the start of the next.

Leaky bucket processes requests at a constant rate, queuing or dropping overflow. It produces perfectly smooth output, ideal for protecting a downstream system that needs steady load, but it does not reward idle time with burst capacity.

Token bucket refills tokens at a steady rate up to a capacity. It allows bursts up to the bucket size while enforcing an average rate, the best fit for APIs where occasional spikes are acceptable.

If a client is idle then sends a spike: fixed window allows it within the window, leaky bucket smooths it out (delaying or dropping), and token bucket allows a burst up to its capacity. Token bucket is the most flexible here.

A rough summary:

• Fixed window: simplest, boundary bursts.
• Sliding window: accurate, more memory.
• Leaky bucket: smooth output, no bursts.
• Token bucket: bursts plus average rate.

A minimal token bucket check refills based on elapsed time, then spends a token if available.

Public API with bursty clients? Token bucket. Protecting a fragile downstream at constant load? Leaky bucket. Simple internal quota, accuracy not critical? Fixed window.

Fixed window needs one integer counter; token and leaky bucket need a token count plus a last-update timestamp. All are cheap, but distributed implementations add coordination cost regardless of algorithm.

Real systems often combine algorithms: a token bucket per user for burst control plus a fixed global cap to protect infrastructure. Layering limits at different scopes is common in production gateways.

You learned to choose an algorithm:

• Fixed window is cheapest but allows boundary bursts.
• Leaky bucket smooths output at a constant rate, no bursts.
• Token bucket allows bursts up to capacity while enforcing an average.
• Match the algorithm to your burst tolerance and downstream needs, and layer limits for real systems.