Rate-limiting a traffic stream using a rate-limit hierarchy involves subjecting a packet to a first rate-limit check, the first rate-limit check corresponding to a first-level traffic classification, subjecting the packet to a second rate-limit check and an infinity rate-limit cheek, the second rate-limit check and the infinity rate-limit check corresponding to a second-level traffic classification, granting an automatic pass to the packet from the infinity rate-limit check regardless of whether or not the packet passes the second rate-limit check, and granting an overall pass of the rate-limit hierarchy if the packet passes the first rate-limit check. In an embodiment, the first-level traffic classification is a parent classification of the second-level traffic classification and the second-level traffic classification is a child classification of the first-level traffic classification.