QoS — Differentiated Services

Why it exists

Links have finite capacity. When demand exceeds that capacity something must wait or be dropped. Differentiated Services lets operators mark packets with a small codepoint and ask each hop to apply a consistent per-hop behaviour — without signalling a reservation through the path.

The six-bit DSCP replaced the older Type-of-Service interpretation of the same octet. Interior routers classify primarily on that codepoint; rich multi-field classification belongs at the edge.

Trust boundary: accept or remark

A packet arrives marked EF. At the domain edge you either accept that mark or rewrite it — DiffServ is hop-by-hop, and an untrusted edge resets the request.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
Phone · DSCP 46	host	DSCP: 46 (EF)
Access · trust edge	switch	—
Core · congested hop	router	—
Phone · DSCP 46 — Access · trust edge	link	up
Access · trust edge — Core · congested hop	link	up

1 / 4

A packet leaves the phone with DSCP 46 — the recommended Expedited Forwarding codepoint. That six-bit label is a request for treatment, not a reservation.

RFC 2474 places the DSCP in the former Type-of-Service octet. The recommended EF codepoint is decimal 46 (binary 101110).

What changed

Emphasis on Phone · DSCP 46
Phone · DSCP 46: DSCP → 46 (EF)
DSCP 46: Phone · DSCP 46 → Access · trust edge

How it works

A DS domain has boundary nodes that classify and condition traffic, and interior nodes that apply PHBs to the codepoints they receive. The trust boundary is the place where marks from outside become marks the domain is willing to honour.

Expedited Forwarding (recommended DSCP 46) targets low delay and low loss for a rate-limited aggregate — typically a priority queue with a policer, not unbounded priority.

Assured Forwarding defines classes with relative forwarding assurance and ordered drop precedences within each class, so congestion discards the “less assured” packets of a class first.

Traffic conditioners meter, mark, shape, or drop. A policer discards (or remarks) out-of-profile traffic; a shaper delays it. The DSCP alone does not decide conform versus exceed — the token-bucket parameters do.

Where active queue management would drop, ECN can mark Congestion Experienced instead so endpoints reduce rate without loss — complementary to DiffServ, not a substitute for a PHB.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Link layer: Ethernet with EtherType 0x0800, or whatever the medium uses to say "IPv4 follows". RFC 791
IPv4 header: Version, length, differentiated services, fragmentation control, TTL, protocol, addresses. RFC 791
Payload: Whatever the protocol field names — 1 for ICMP, 6 for TCP, 17 for UDP, 89 for OSPF, 103 for PIM. RFC 791

Configure it

```
class-map match-all VOICE
 match dscp ef
```
Matches the recommended EF codepoint (DSCP 46). Classification here is by DSCP alone — multi-field matching belongs at the trust edge if hosts cannot be trusted.
RFC 3246 §2.7
```
policy-map WAN-EDGE
 class VOICE
  priority percent 10
  police cir percent 10
 class class-default
  bandwidth remaining percent 90
  fair-queue
```
Maps EF to a low-latency queue and meters that aggregate so priority cannot starve class-default. Remaining bandwidth serves best-effort with fair-queue.
Common mistake: Configuring `priority` without policing the EF class. Unbounded priority lets any volume of EF-marked traffic consume the scheduler.
RFC 3246 §2.2
```
interface GigabitEthernet0/0/1
 service-policy output WAN-EDGE
```
Applies the policy in the outbound direction on the congested interface — the direction where queueing actually happens.

Verify

show policy-map interface GigabitEthernet0/0/1: VOICE class counters and policer conform/exceed counts under load.
show interfaces GigabitEthernet0/0/1: Output queue drops and rates; not a substitute for reading DSCP on ingress.

Caveats

Marked draft: MQC syntax and percentage policing behaviour vary by platform and release.
Trust / remark on the access port is not shown; without it, EF marks from untrusted hosts may already be zero.

When it breaks

Symptom first, because that is what you have when it happens.

A policy is configured and marked traffic is still being dropped during congestion.
Narrow it down
1. Check where the trust boundary is and whether the marking survived it.
2. Read the marking on ingress at the congested hop, not at the source.
3. Confirm the queueing policy is applied in the right direction on the right interface.
Cause
The marking was rewritten. A port that does not trust incoming markings resets DSCP to zero by default, so traffic arrives at the congested hop looking like everything else.
Fix
Establish the trust boundary explicitly and verify the marking at every hop. Quality of service is hop-by-hop: any device that does not honour it erases the work of the ones before it.
Voice quality is poor under load even though voice is in a priority queue with plenty of bandwidth.
Narrow it down
1. Check the size of the queues, not just their share of bandwidth.
2. Measure jitter rather than loss.
3. Look for a large buffer in front of the bottleneck.
Cause
Bufferbloat. A queue deep enough to avoid drops adds delay proportional to its depth, and delay is what voice is sensitive to. Bandwidth was never the constraint.
Fix
Shrink the queue or use an active queue management scheme. For real-time traffic, dropping early beats queueing long.
A policer is configured at the contracted rate and throughput comes out well below it.
Narrow it down
1. Check the burst size against the bandwidth-delay product of the path.
2. Look at whether the drops are clustered at the start of transfers.
3. Compare a policer against a shaper on the same traffic.
Cause
A burst allowance too small for the path. TCP sends in bursts, and a policer with a tight bucket drops the head of each one, which TCP reads as congestion and backs off from.
Fix
Size the burst to the bandwidth-delay product, or shape instead of policing. A shaper delays the burst; a policer discards it, and TCP responds very differently to the two.
Best-effort traffic collapses whenever any voice or “EF” flow is active, even at modest call volumes.
Narrow it down
1. Confirm whether the EF (or priority) queue is rate-limited.
2. Measure how much traffic carries the EF codepoint during the failure.
3. Check whether unmarked or mis-marked traffic is landing in the priority queue.
Cause
EF without an aggregate policer — or a classifier that stuffs bulk traffic into the priority queue. The PHB is defined for a rate-limited aggregate; unbounded priority starves everything else.
Fix
Police the EF aggregate to the rate the PHB was engineered for, and keep classifiers tight so only real-time traffic receives that mark.
Within a single AF class, “important” and “less important” flows drop together under congestion.
Narrow it down
1. Check which AF codepoints are in use (drop precedence within the class).
2. Confirm the scheduler treats them as one AF class with differentiated discard, not as identical best-effort.
3. Look for a remark that collapsed several drop precedences to one codepoint.
Cause
Assured Forwarding expects ordered discard within a class: higher drop-precedence packets are dropped preferentially. Flattening those codepoints removes the relative assurance AF was designed to provide.
Fix
Preserve AF drop-precedence markings through the path and enable differentiated discard (for example WRED profiles per precedence) on the congested hop.

Design notes

Marking without a queueing policy changes a header field and nothing else. Every hop that matters must map the codepoint to a PHB, and any hop that rewrites the mark undoes the work upstream.

Do not mix DiffServ PHB vocabulary with data-centre lossless priorities (PFC/ETS/DCBX). They solve different problems on different layers and are not interchangeable labels for “important traffic.”

On an uncongested link a QoS policy does nothing measurable. Continuous congestion is a capacity problem; policy only chooses who suffers while you fix it.

Misconceptions

“Quality of service creates bandwidth.”: It decides who suffers when there is not enough. On an uncongested link it does nothing at all, and if a link is congested continuously the only real fix is more capacity — a policy just chooses which traffic is sacrificed.
“Marking traffic is enough.”: A marking is a request. Something has to act on it at every hop, and a hop that does not is not a partial improvement — it is a full reset. Marking without a queueing policy changes nothing except a header field.
“Policing and shaping are two names for rate limiting.”: A policer drops what exceeds the rate; a shaper buffers and delays it. Against TCP the difference is large: the shaper slows the sender smoothly, the policer teaches it there is loss.

More walkthroughs

EF is priority with a policerbaseline

Expedited Forwarding asks for low delay and low loss, but the PHB is not unlimited priority — rate-limiting the EF aggregate protects everything else.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
Voice · EF	host	DSCP: 46
Bulk · BE	host	DSCP: 0
Edge · EF PHB	router	—
Far end	router	—
Voice · EF — Edge · EF PHB	link	up
Bulk · BE — Edge · EF PHB	link	up
Edge · EF PHB — Far end	link	up

1 / 4

Voice is marked DSCP 46. Bulk traffic uses the default PHB. Both arrive at an edge that implements Expedited Forwarding for that codepoint.

What changed

Voice · EF: DSCP → 46
Bulk · BE: DSCP → 0
EF: Voice · EF → Edge · EF PHB
BE: Bulk · BE → Edge · EF PHB

Policer drops; shaper delayscomparison

Both enforce a rate with a token bucket, but a policer discards excess while a shaper buffers it — TCP reads those outcomes very differently.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
TCP sender	host	—
Conditioner	router	Meter: CIR / burst tokens
Receiver	host	—
TCP sender — Conditioner	link	up
Conditioner — Receiver	link	up

1 / 4

TCP sends in bursts. The contracted rate is a token-bucket profile — committed rate and burst size — not the DSCP alone.

What changed

Emphasis on TCP sender
Burst: TCP sender → Conditioner
Conditioner: Meter → CIR / burst tokens

Terms

DSCP: Differentiated Services Code Point: the six-bit label in the IPv4/IPv6 DS field that selects a per-hop behaviour. It requests treatment; it does not reserve bandwidth.
PHB: Per-hop behaviour: the forwarding treatment a DS-compliant node applies to packets with a given codepoint — queueing, scheduling, and discard — not an end-to-end guarantee.
Trust boundary: The edge of a DiffServ domain where markings from outside are accepted or rewritten. Interior nodes are expected to act on the codepoints the boundary left them.

Check yourself

A port is configured not to trust incoming DSCP. What happens to marked traffic?
Voice is in a priority queue with ample bandwidth but sounds poor. What should you look at?
How does a shaper differ from a policer?
On a link that is never congested, what does a quality-of-service policy do?
What DSCP value does RFC 3246 recommend for Expedited Forwarding?
Why does an EF PHB include metering of the EF aggregate?
Within one Assured Forwarding class, what do different drop-precedence codepoints do?
A network marks voice as DSCP 46 but never configures queues. What changes?

Why it exists

Trust boundary: accept or remark

How it works

On the wire

Configure it

Verify

Caveats

When it breaks

A policy is configured and marked traffic is still being dropped during congestion.

Narrow it down

Cause

Fix

Voice quality is poor under load even though voice is in a priority queue with plenty of bandwidth.

Narrow it down

Cause

Fix

A policer is configured at the contracted rate and throughput comes out well below it.

Narrow it down

Cause

Fix

Best-effort traffic collapses whenever any voice or “EF” flow is active, even at modest call volumes.

Narrow it down

Cause

Fix

Within a single AF class, “important” and “less important” flows drop together under congestion.

Narrow it down

Cause

Fix

Design notes

Misconceptions

More walkthroughs

EF is priority with a policerbaseline

Policer drops; shaper delayscomparison

Terms

Check yourself

Related

TCP

VLANs