Course contents

Chapter 11: IP Services on IOSLesson 8 of 10

QoS classification and marking

CoS, IP precedence and DSCP values, EF and AF, trust boundaries and a simple MQC marking policy.

Intermediate · 10 min read

Technical definition

Classification and marking are the first QoS steps: classification identifies which class a packet belongs to, and marking writes that class into the packet header, as a DSCP or CoS value, so every device along the path can treat it the same way.

Where the marking lives

Where QoS markings live: CoS in the Layer 2 tag, DSCP in the IP header
Where QoS markings live: CoS in the Layer 2 tag, DSCP in the IP headerAn 802.1Q tag has a 3-bit class-of-service field. The IP header has an 8-bit Type of Service byte, of which 6 bits are DSCP and 2 bits are ECN. DSCP value 46 is Expedited Forwarding, used for voice.Layer 2: 802.1Q tagTPID 16 bitsPCP/CoS 3 bitsDEIVLAN ID 12 bitsLayer 3: IP header ToS byteDSCP: 6 bits (0 to 63)ECN: 2 bitsCommon DSCP: EF 46 (voice) · AF41 34 (video) · AF21 18 (transactional) · CS0/default 0 (best effort)Cisco rule of thumb: voice CoS 5 / DSCP EF, signalling CoS 3 / CS3, default 0.
Markings let every device along the path recognise the class without inspecting the application. Layer 2 CoS is lost when the frame leaves the VLAN, so switches often map CoS to DSCP.

Layer 2 frames carry a 3-bit CoS (class of service, 0 to 7) in the 802.1Q tag. IP packets carry a 6-bit DSCP in the ToS byte, giving 64 possible values. The older IP precedence is simply the first three bits of that same byte. Because CoS exists only on tagged links, it disappears when the frame is routed; DSCP stays with the packet end to end.

Common markings

Typical QoS markings by traffic class
Typical QoS markings by traffic classTraffic; DSCP name and value; CoS; Behaviour wanted. Voice bearer (RTP): EF, 46 5 Low delay and jitter, priority queue Interactive video: AF41, 34 4 Guaranteed bandwidth Call signalling: CS3, 24 3 Reliable delivery Transactional data: AF21, 18 2 Guaranteed bandwidth, then drop precedence Network control, routing: CS6, 48 6 Protect protocol traffic Best effort (default): 0 0 No guaranteeTrafficDSCP name and valueCoSBehaviour wantedVoice bearer (RTP)EF, 465Low delay and jitter,priority queueInteractive videoAF41, 344Guaranteed bandwidthCall signallingCS3, 243Reliable deliveryTransactional dataAF21, 182Guaranteed bandwidth,then drop precedenceNetwork control,routingCS6, 486Protect protocol trafficBest effort(default)00No guarantee

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Values follow common enterprise practice and Cisco guidance. Your organisation may choose a different scheme, so read the QoS policy before changing markings.

Reading DSCP

EF is 46, which is 101110 in binary. AF values follow the pattern 8x + 2y, so AF41 is 34 and AF21 is 18. CS values are multiples of 8: CS3 = 24, CS6 = 48.

Trust boundaries

  1. Mark or re-mark as close to the source as possible, usually on the access switch.
  2. Trust markings only from devices you control, such as an IP phone.
  3. Re-mark everything else, so a user cannot claim priority by setting EF on their own traffic.

A simple marking policy

Example commands and output on this page were written from Cisco IOS documentation and generally described behaviour. They were not captured from a live device, so prompts and details can differ on your platform and version.

ip access-list extended VOICE-RTP permit udp any any range 16384 32767 class-map match-all VOICE match access-group name VOICE-RTP policy-map MARK-IN class VOICE set dscp ef interface GigabitEthernet0/1 service-policy input MARK-IN

MQC in three parts: a class-map identifies the traffic, a policy-map sets the marking, and service-policy applies it to the interface. Platform syntax for QoS on access switches varies.

Test yourself

Predict · scenario 1

What DSCP value does AF31 equal?

Predict · scenario 2

Which marking is normally used for voice bearer traffic?

Predict · scenario 3

Why does an access switch re-mark traffic from a user PC?

FAQ

What is the difference between classification and marking?
Classification decides which class a packet belongs to using an ACL, a port, a protocol or an existing marking. Marking changes the header value. You can classify without marking, but marking makes later classification trivial.
What is a trust boundary?
The point in the network where you start believing the markings on packets. Traffic from an IP phone can be trusted; traffic from a PC usually is not, so the access switch re-marks it. Marking close to the source keeps the rest of the network simple.
How do I turn an AF name into a number?
AFxy has class x (1 to 4) and drop precedence y (1 to 3). The DSCP value is 8x + 2y. AF41 is 8×4 + 2×1 = 34; AF31 is 26; AF21 is 18; AF11 is 10.