The dangerous implementation is not one that never works. It is one that works in a demo and loses its boundaries under real networks and real data volume. A host-wide cap lets early elephant flows fill the queue. Hierarchical shaping limits an actor then fairly schedules allocations with short bursts.
TURN is a metered shared relay, not merely an ICE URL. Operate short-lived authorization, allocation concurrency, byte accounting, regional capacity, and abuse response while preserving UDP, TCP, and TLS reachability.
Engineering boundaries and tradeoffs
List non-negotiable invariants before selecting performance knobs. Tuning can roll out gradually; identity, permission, and terminal-state rules cannot drift at runtime.
- Configure sustained rate and burst bytes per actor, degrade by weight near node egress limits, and keep control packets out of long bulk FIFOs.
- Bound every input by size, count, and time, returning a stable actionable error code when a budget is exceeded.
- Retries need an idempotency key, backoff, and deadline; after the deadline create a new task instead of reviving old callbacks.
The delivery standard for Fair TURN Bandwidth Shaping Between Large and Small Flows is a usable normal path, convergent failures, bounded resources, and a state users can understand. The result is a production capability that can be explained, degraded safely, and rolled back—not a demo that works once.
How it fails in production
An abnormal path is more than an error banner. It decides how in-flight work stops, how the peer learns the outcome, what residue remains, and whether the next operation inherits it.
- Equal per-allocation rates reward attackers who open more allocations, while tiny bursts make normal WebRTC bursts stutter.
- A boolean failure cannot distinguish retryable, user-action, and permanent refusal, producing an endless loop.
- Without backpressure or quota, a slow consumer raises memory, queue depth, and tail latency until unrelated users are affected.
Turn testing into a closed loop
Observe both endpoints, persisted records, and operational signals during verification. One button state or one successful response cannot prove the complete loop.
- Run one large file, ten small files, and screen sharing, then add allocations for one user; measure fairness, p95 control latency, and egress.
- Disconnect, change networks, and recover mid-operation; reconcile endpoint state, persistence, and resource counts.
- Cover direct, relayed, weak-network, background-tab, and mobile paths; do not rely on averages or one successful screenshot.
A capability becomes maintainable when it degrades safely, repetition adds no side effects, and its signals reveal a fault before user reports do.