QoS Marking – DSCP, CoS & IP Precedence

1. Why QoS Marking Matters

A network carries many different types of traffic simultaneously — voice calls, video conferences, file transfers, web browsing, and background backups. Each has very different tolerance for delay, jitter, and packet loss. Without Quality of Service (QoS), every packet is treated identically — a VoIP frame and a large file transfer compete equally for bandwidth, causing voice to stutter and video to freeze under load.

Marking is the first and most foundational step in QoS: attaching a priority label to each packet so that every device along the path knows how to treat it. A marked packet can be queued, scheduled, dropped (or protected from dropping), and policed based on its mark — without the network device needing to re-inspect the packet contents every hop.

Related pages: QoS Overview | QoS Queuing | QoS Policing & Shaping | VLANs | 802.1Q VLAN Tagging | ACL Overview (traffic classification) | Voice VLAN | DSCP Marking & Classification Lab | MQC QoS Basics Lab

2. The Three QoS Marking Fields

Three marking fields are used in modern networks. They operate at different layers and serve different scopes. Understanding which field applies where is essential for both the CCNA exam and real-world network design.

  IPv4 Type of Service (ToS) byte — 8 bits total:
  ┌──────────────────────────────────────────────────────┐
  │  Bit 7  Bit 6  Bit 5  Bit 4  Bit 3  Bit 2  Bit 1  Bit 0 │
  └──────────────────────────────────────────────────────┘

  IP Precedence interpretation (legacy — uses upper 3 bits):
  ┌─────────────┬────────────────────────────────────────┐
  │  IPP (3 b)  │         Unused (5 bits)                │
  └─────────────┴────────────────────────────────────────┘
  Bits 7-5: Priority 0 (BE) to 7 (Network Control)

  DSCP / DiffServ interpretation (modern — uses upper 6 bits):
  ┌─────────────────────────────┬──────────┐
  │        DSCP (6 bits)        │ ECN(2 b) │
  │  (Differentiated Services   │          │
  │   Code Point = DS field)    │          │
  └─────────────────────────────┴──────────┘
  Bits 7-2: DSCP value 0–63
  Bits 1-0: ECN (Explicit Congestion Notification — not QoS marking)

3. CoS — Class of Service (Layer 2 Marking)

CoS (Class of Service) is the Layer 2 QoS marking carried in the Priority Code Point (PCP) field of an 802.1Q VLAN tag. It is also referred to as 802.1p priority. CoS is a 3-bit field providing values 0 through 7 — where 0 is lowest priority (best effort) and 7 is highest (reserved for network control).

  802.1Q frame tag — 4 bytes total:
  ┌──────────────┬───┬──────────────────────────┐
  │  TPID        │TCI                            │
  │  (2 bytes)   │  (2 bytes)                    │
  │  0x8100      ├─────┬───┬───────────────────── │
  │              │ PCP │DEI│      VID             │
  │              │(3b) │(1b)│   (12 bits)          │
  └──────────────┴─────┴───┴──────────────────────┘
                    ▲
                    CoS / 802.1p priority (0–7)

  CoS field is ONLY present when an 802.1Q tag exists.
  → Present on: trunk links between switches/routers
  → Absent on:  access ports (tag stripped before delivery to end device)

CoS Values and Meanings

4. DSCP — Differentiated Services Code Point

DSCP (Differentiated Services Code Point) is the modern Layer 3 QoS marking standard, defined in RFC 2474 as part of the DiffServ (Differentiated Services) architecture. It uses the upper 6 bits of the IPv4 ToS byte (or the IPv6 Traffic Class byte), providing 64 possible values (0–63). DSCP markings are end-to-end — they survive routing hops and are the primary marking mechanism for enterprise and service provider QoS.

DSCP values are organised into named classes that describe forwarding behaviour. The four main DSCP classes — EF, AF, CS, and BE — each serve a distinct purpose and have standardised numeric values.

  DSCP 6-bit field values and their binary breakdown:

  DSCP decimal value = (binary value of 6 bits, reading bits 7 down to 2)

  Examples:
  DSCP 46 (EF)  = binary 101110 = bits 7-2 set to 1,0,1,1,1,0
  DSCP 34 (AF41)= binary 100010 = bits 7-2 set to 1,0,0,0,1,0
  DSCP 0  (BE)  = binary 000000 = all zero

  Decimal to per-hop behaviour name mapping:
  0   = Best Effort (BE) / CS0
  8   = CS1  (Class Selector 1)
  10  = AF11, 12 = AF12, 14 = AF13
  16  = CS2
  18  = AF21, 20 = AF22, 22 = AF23
  24  = CS3
  26  = AF31, 28 = AF32, 30 = AF33
  32  = CS4
  34  = AF41, 36 = AF42, 38 = AF43
  40  = CS5
  46  = EF  (Expedited Forwarding) ← voice / highest user data priority
  48  = CS6
  56  = CS7

5. The Four DSCP Classes — EF, AF, CS, and BE

5.1 EF — Expedited Forwarding (DSCP 46)

EF (Expedited Forwarding), DSCP value 46 (binary 101110), is the highest-priority per-hop behaviour for user traffic. It is defined in RFC 3246 and is used exclusively for traffic that requires minimum delay, minimum jitter, and minimum loss — the characteristics that voice (VoIP RTP) demands.

  EF — key characteristics:
  DSCP value:  46
  Binary:      101110
  IP Prec:     5 (upper 3 bits = 101)
  CoS equiv:   5
  Use:         VoIP RTP audio, real-time interactive voice
  Queueing:    Strict Priority Queue (PQ / LLQ) — sent before all other traffic
  Bandwidth:   Should be limited to ≤33% of link capacity to prevent
               EF traffic from starving all other classes

5.2 AF — Assured Forwarding (AF11–AF43)

AF (Assured Forwarding) is defined in RFC 2597 and provides four traffic classes (AF1x through AF4x), each with three drop precedences (low, medium, high). AF gives a traffic class a guaranteed minimum bandwidth allocation and defines how aggressively packets within that class are dropped when congestion occurs.

  AF naming convention: AF [Class] [Drop Precedence]

  Class:          1 = lowest AF priority,  4 = highest AF priority
  Drop Precedence:1 = low drop,  2 = medium drop,  3 = high drop

  ┌─────────┬────────────────────────────────────────────────────┐
  │  Name   │  DSCP Dec │  DSCP Bin │  Drop Prob  │  Typical Use │
  ├─────────┼───────────┼───────────┼─────────────┼──────────────┤
  │  AF11   │    10     │  001010   │  Low        │  Bulk data   │
  │  AF12   │    12     │  001100   │  Medium     │  Bulk data   │
  │  AF13   │    14     │  001110   │  High       │  Bulk data   │
  ├─────────┼───────────┼───────────┼─────────────┼──────────────┤
  │  AF21   │    18     │  010010   │  Low        │  Data apps   │
  │  AF22   │    20     │  010100   │  Medium     │  Data apps   │
  │  AF23   │    22     │  010110   │  High       │  Data apps   │
  ├─────────┼───────────┼───────────┼─────────────┼──────────────┤
  │  AF31   │    26     │  011010   │  Low        │  Business    │
  │  AF32   │    28     │  011100   │  Medium     │  apps        │
  │  AF33   │    30     │  011110   │  High       │  (CRM, ERP)  │
  ├─────────┼───────────┼───────────┼─────────────┼──────────────┤
  │  AF41   │    34     │  100010   │  Low        │  Video conf  │
  │  AF42   │    36     │  100100   │  Medium     │  Video conf  │
  │  AF43   │    38     │  100110   │  High       │  Video conf  │
  └─────────┴───────────┴───────────┴─────────────┴──────────────┘

  Drop precedence within a class:
  AF_1 (low drop)   → kept longest during congestion
  AF_3 (high drop)  → dropped first during congestion (within the same class)

  WRED (Weighted Random Early Detection) uses drop precedence to
  selectively pre-drop packets before a queue fills completely.

5.3 CS — Class Selector (CS0–CS7)

CS (Class Selector) values (CS0–CS7) are defined in RFC 2474 for backward compatibility with the old IP Precedence 3-bit system. Class Selectors use only the upper 3 bits of the 6-bit DSCP field (the lower 3 bits are always 0), so their decimal values are exact multiples of 8: CS0=0, CS1=8, CS2=16, CS3=24, CS4=32, CS5=40, CS6=48, CS7=56.

5.4 BE — Best Effort (DSCP 0)

BE (Best Effort) is DSCP value 0 — all six bits are zero. It is the default class for all traffic that has not been marked by any QoS policy. Best Effort traffic receives no bandwidth guarantee and no protection from drops. It is served only when higher-priority queues are empty. The vast majority of internet traffic is Best Effort.

6. IP Precedence — The Legacy System

IP Precedence (IPP) is the original 3-bit QoS marking field defined in RFC 791 (1981) as part of the IPv4 ToS byte. It provides 8 values (0–7). IP Precedence is a legacy standard — modern networks use DSCP — but it remains relevant because DSCP was designed to be backward compatible with it, and some older devices still mark or read IP Precedence.

  Relationship between IP Precedence, CS, and DSCP:

  IP Precedence  CS Name   DSCP Dec   Notes
  ─────────────  ────────  ─────────  ──────────────────────────────
       7          CS7         56      Multiples of 8 — the CS values
       6          CS6         48      map directly to IP Precedence
       5          CS5         40      (DSCP = IPP × 8)
       4          CS4         32
       3          CS3         24
       2          CS2         16
       1          CS1          8
       0          CS0/BE       0

  Additional DSCP values between CS multiples (non-zero lower 3 bits):
  EF = 46 (between CS5=40 and CS6=48) — IPP bits read as 5
  AF41 = 34, AF42 = 36, AF43 = 38 (between CS4=32 and CS5=40)
  AF31 = 26, AF32 = 28, AF33 = 30 (between CS3=24 and CS4=32)

7. DSCP Quick-Reference Table — All Key Values

8. Where Marking Happens — Trust Boundaries

Marking should happen as close to the traffic source as possible — but only where the source is trusted. The point in the network where QoS marks are accepted as valid (or re-marked to enforce policy) is called the trust boundary. Beyond the trust boundary, the network honours the marks. At the trust boundary itself, the network verifies or re-marks.

  Trust boundary placement:

  [IP Phone]──CoS5/EF──►[Access Switch]──CoS5/EF──►[Distribution]──►[WAN Router]
                              ▲
                        Trust boundary
                        (switch trusts IP phone markings
                         because phones are known devices)

  [PC]──CoS0/BE──►[Access Switch]──CoS0/BE──►[Distribution]
         ▲               │
     Untrusted        Re-marks PC traffic
     (PCs can mark    to appropriate DSCP
      their own        based on application
      packets to       (NBAR or ACL)
      any value)

  The access switch is the typical trust boundary for end-user segments:
  → Phones:  trust the marking (CoS 5 / DSCP EF)
  → PCs:     do NOT trust — re-mark or override

Trust Boundary Principles

Cisco Switch Trust Commands

  ! Trust CoS markings arriving on the access port (e.g., from IP phone):
  Switch(config-if)# mls qos trust cos

  ! Trust DSCP markings arriving on the port:
  Switch(config-if)# mls qos trust dscp

  ! Trust IP Precedence:
  Switch(config-if)# mls qos trust ip-precedence

  ! Do not trust (default on access ports — re-mark to DSCP 0):
  Switch(config-if)# no mls qos trust

  ! Enable MQC QoS globally on a Catalyst switch (required first):
  Switch(config)# mls qos

9. Marking with Cisco IOS MQC — Configuration

On Cisco routers and Layer 3 switches, QoS marking is configured using the Modular QoS CLI (MQC) framework — the same class-map / policy-map structure used for queuing and policing. Traffic is first classified (identified), then marked with the appropriate DSCP or CoS value.

Example — Marking VoIP and Business Traffic on a WAN Router

  Scenario: An access router must mark traffic from the inside LAN before
  forwarding it across a WAN link. VoIP is marked EF; video is marked AF41;
  business apps are marked AF31; everything else is marked BE.

  ! Step 1 — Classify traffic with ACLs or NBAR:
  ip access-list extended VOIP-ACL
   permit udp any any range 16384 32767
   ! (RTP audio port range — adjust for your deployment)

  ip access-list extended VIDEO-ACL
   permit tcp any any eq 1720
   permit udp any any eq 5004

  ! Step 2 — Class maps to match traffic:
  class-map match-any VOIP-CLASS
   match access-group name VOIP-ACL

  class-map match-any VIDEO-CLASS
   match access-group name VIDEO-ACL

  class-map match-any BUSINESS-CLASS
   match protocol http
   match protocol https
   match protocol citrix

  ! Step 3 — Policy map to mark DSCP:
  policy-map MARK-POLICY
   class VOIP-CLASS
    set dscp ef
   class VIDEO-CLASS
    set dscp af41
   class BUSINESS-CLASS
    set dscp af31
   class class-default
    set dscp default
    ! 'default' = DSCP 0 / BE

  ! Step 4 — Apply policy map to interface (inbound = mark on ingress):
  interface GigabitEthernet0/0
   service-policy input MARK-POLICY

Marking CoS on a Trunk Interface

  ! Set CoS 5 for voice traffic leaving a trunk port:
  policy-map MARK-COS-POLICY
   class VOIP-CLASS
    set cos 5
   class VIDEO-CLASS
    set cos 4
   class class-default
    set cos 0

  interface GigabitEthernet0/1
   switchport mode trunk
   service-policy output MARK-COS-POLICY

Verification Commands

  ! Verify QoS policy is applied to interface:
  Router# show policy-map interface GigabitEthernet0/0

  ! Show class-map configuration:
  Router# show class-map

  ! Show policy-map details:
  Router# show policy-map MARK-POLICY

  ! Check DSCP markings on packets (Wireshark / debug):
  Router# debug ip packet detail
  ! (caution — very verbose on busy interfaces)

  ! On Catalyst switches — verify trust settings:
  Switch# show mls qos interface GigabitEthernet0/1
  Switch# show mls qos interface GigabitEthernet0/1 queueing

See also: QoS Queuing | QoS Policing & Shaping | DSCP Marking Lab | MQC QoS Basics Lab | CBWFQ & LLQ Lab

10. CoS-to-DSCP and DSCP-to-CoS Mapping

When traffic crosses a boundary between a Layer 2 domain (where CoS exists) and a Layer 3 domain (where DSCP exists), the QoS marks must be translated. Cisco switches and routers maintain mapping tables that convert CoS to DSCP (when a tagged frame is routed) and DSCP to CoS (when a routed packet is forwarded onto a trunk link).

Default Cisco CoS-to-DSCP Mapping

  ! View the current CoS-to-DSCP mapping table on a Catalyst switch:
  Switch# show mls qos maps cos-dscp

  CoS-to-DSCP map:
  cos:  0   1   2   3   4   5   6   7
        ↓   ↓   ↓   ↓   ↓   ↓   ↓   ↓
  dscp: 0   8  16  24  32  46  48  56

  ! Customise the mapping (rarely needed — default is industry standard):
  Switch(config)# mls qos map cos-dscp 0 8 16 24 32 46 48 56

See also: QoS Overview | QoS Queuing | QoS Policing & Shaping | VLANs | 802.1Q VLAN Tagging | Voice VLAN | DSCP Marking Lab

Test Your Knowledge — QoS Marking Quiz