A rate limiter drops requests arriving at a rate exceeding a limit. A rate shaper slows down processing rate to avoid exceeding the desired maximum rate. As it doesn't drop requests, there is a risk of queue overflow. The optimal choice between the two depends on the type of application and the desired kind of protection. EDIT: A combination of the two would probably be better.