Queue at-rate not honoured

Hello,
We have an issue with our queues. With three groups we have purchased 1 Gb. We agreed to share this equally, with unused bandwidth available to the others.
The understanding is that each group always has a minimum of 330 Mbps available.

This appears to be not the case. From time to time very high download are initiated from one station, peaking at 600 Mbps or more. During these periods the other groups have less than 330 Mbps.
A few of these events, lasting up to 10 minutes, are visible in the screenshot below.
queue.png
Below are the queues we are using.
Is there something we are doing wrong?

Thanks!
0
name=“global” target=185.106.160.0/22 parent=none packet-marks=“” priority=2/2 queue=default-small/default-small
limit-at=1G/1G max-limit=1G/1G burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s bucket-size=0.1/0.1

1
name=“group1” target=vlan100 parent=global packet-marks=“” priority=2/2 queue=default-small/default-small
limit-at=330M/330M max-limit=660M/660M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s bucket-size=0.1/0.1

2
name=“group2” target=vlan110 parent=global packet-marks=“” priority=2/2 queue=default-small/default-small
limit-at=330M/330M max-limit=660M/660M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s bucket-size=0.1/0.1

3
name=“group3” target=ether3 parent=global packet-marks=“” priority=2/2 queue=default-small/default-small
limit-at=330M/330M max-limit=660M/660M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s bucket-size=0.1/0.1

But you have allowed a max limit of 660Mbps… The graph shows something less than 600Mbps…
No limit is exceeded…


During these periods the other groups have less than 330 Mbps.

Did they actually needed more Bandwidth and they could not have it ?

Thanks,
Actually - the other groups were cut - you can see that in the picture for one group. This dropped from close to 100 Mbps to near zero (scale is missing in the lower picture - max is 150 Mbps). The other group had similar drops - dropping from about 180 to close to zero. I would have expected the 300 Mbps at-rate to be honoured.
One obvious cause may be that we do not get the 1 Gbps from our provider. If they only provide, say, 600 Mbps, the ques will be at their network. If they favour the high download, the packets of the other two groups will not even reach the router…

I just want to make sure that we did not somehow made an error in our configuration.
Looks like I have to find a server providing a bit over 1 Mbps to test our service…

One obvious cause may be that we do not get the 1 Gbps from our provider

Well, exactly, if you are not sure of the Bandwidth the ISP gave you at the moment you can’t blame the queues…

Indeed. More testing is required.
Another event occurred last Monday - caused by high downloads from one user. I noticed - using the graphs that the input to our main queue was receiving near 1000 Mbps.
See below. The queue of the group with the client initiating the traffic peaks at 660 (see below second graph).
The other groups were affected as last time.

I had installed trafficFlow and estimated the flowrates from it (I realise that flowrates derived from traffic flow are imprecise - but it matches well with flowrates retrieved from other surveillance).
The interesting thing is that those rates peaked at about 300 Mbps for one group, the total reaching about 430 Mbps - not anywhere close to 1000 Mbps.
My understanding is that flowtraffic is computed at the end of the FORWARD chain.
Could traffic be dropped before it reaches that point?
What would cause this to happen?
comboport.png
client1.png
flowEstimates.png

Well, the HTB Interface as you will see from the Packet flow Diagram https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS#PacketFlowinRouterOS-Example1 is just before the exit of the Physical Interface and more specifically in the Postrouting Chain…

Also, as for the limit-at we discussed eariler in the post, it is a guaranteed bandwidth and when any client needs it it will certainly get it… Even if the Max Limit of the Parent is less than the actual needs of the limit-at values, the Parent’s MAX Limit will be exceeded just to satisfy the limit-at rules…

What i would test is, create a Traffic from a Client reaching it’s MAX limit,660 Mbps for a a period of lets say 1 minute or longer and at that 1 minute i would closely look how the other clients behave.. do they get their limit-at values?
Because the graph shows just a quick drop that it might actually be nothing…

Also, in the child queues instead of Queue Type default small, i would try PCQ Upload default and PCQ Download Default types…