Courseiva
QoSClass-map Config

match dscp [value]

Matches packets based on the DSCP value in the IP header for classification in a class map.

Definition: match dscp [value] is a Cisco IOS class-map config command. Matches packets based on the DSCP value in the IP header for classification in a class map.

Overview

The `match dscp` command is a critical tool in Cisco IOS Quality of Service (QoS) configuration, used within a class map to classify packets based on the Differentiated Services Code Point (DSCP) value in the IP header. DSCP is a 6-bit field in the IP header that allows network devices to apply per-hop behaviors (PHBs) for traffic prioritization, congestion management, and service-level agreements. This command is essential for implementing differentiated services (DiffServ) architectures, where traffic is marked and treated according to its class.

Network engineers reach for `match dscp` when they need to identify traffic by its DSCP marking—for example, to prioritize voice (EF, 46) or video (AF41, 34) traffic, or to police or remark certain DSCP values. It is often used in conjunction with `match ip dscp` (which is actually the same command in class-map config mode) and is preferred over `match access-group` for DSCP-based classification because it directly inspects the DSCP field without requiring an access list. The command fits into the QoS workflow: first, classify traffic with a class map using `match dscp`; then, apply policies (e.g., bandwidth guarantee, policing, marking) in a policy map; finally, attach the policy map to an interface.

Important IOS behaviors: the command is available in class-map configuration mode (entered via `class-map [match-any | match-all] <name>`). It does not require privileged EXEC mode; it is configured in global configuration mode. The command does not buffer output; it modifies the running configuration immediately.

There is no specific privilege level requirement beyond basic configuration privileges (level 15 or appropriate privilege). The command can match multiple DSCP values in a single class map by repeating the `match dscp` statement (for match-any) or listing multiple values (for match-all). Common mistakes include confusing DSCP values with IP precedence (which uses the first 3 bits of the DSCP field) and forgetting that DSCP values are often expressed in decimal (e.g., 46 for EF) or as keywords (e.g., ef, af41).

The command is supported in Cisco IOS, IOS-XE, and IOS-XR, with slight syntax differences in NX-OS (where it is `match dscp` as well, but in a different configuration context). Understanding this command is fundamental for QoS implementation in enterprise and service provider networks.

Syntax·Class-map Config
match dscp [value]

When to Use This Command

  • Classify VoIP traffic marked with DSCP EF for priority queuing.
  • Identify video conferencing traffic using DSCP AF41 for bandwidth guarantee.
  • Match network control traffic with DSCP CS6 for low-latency treatment.
  • Filter traffic with specific DSCP values for remarking or policing.

Parameters

ParameterSyntaxDescription
dscp-value<0-63> | af11 | af12 | af13 | af21 | af22 | af23 | af31 | af32 | af33 | af41 | af42 | af43 | cs1 | cs2 | cs3 | cs4 | cs5 | cs6 | cs7 | default | efSpecifies the DSCP value to match. Can be a decimal number from 0 to 63 or a keyword representing standard DSCP values (e.g., ef for Expedited Forwarding, af41 for Assured Forwarding class 4 low drop). Common mistake: using IP precedence values (0-7) instead of DSCP; for example, IP precedence 5 is not the same as DSCP 40 (CS5). Also, ensure the keyword is lowercase.

Command Examples

Match DSCP EF for VoIP traffic

match dscp ef

This command matches packets with DSCP value EF (46), commonly used for voice traffic.

Match multiple DSCP values for video and voice

match dscp ef af41

Matches packets with DSCP EF (46) or AF41 (34), used for voice and video respectively.

Understanding the Output

This command does not produce output directly; it is used within a class-map configuration. To verify, use 'show class-map' to see the match criteria. The class map will list the DSCP values matched.

A correct configuration shows the expected DSCP values; missing or incorrect values indicate a configuration error.

Configuration Scenarios

Classify Voice Traffic for Priority Queuing

A network engineer needs to prioritize voice traffic (marked with DSCP EF, value 46) over other traffic on a WAN link to ensure low latency and jitter. This scenario creates a class map to match voice packets and then applies a priority queue in a policy map.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a class map named VOICE: class-map match-any VOICE
  3. 3.Step 3: Match DSCP EF: match dscp ef
  4. 4.Step 4: Exit class-map configuration: exit
  5. 5.Step 5: Create a policy map named QOS: policy-map QOS
  6. 6.Step 6: Associate the class map: class VOICE
  7. 7.Step 7: Set priority (bandwidth in kbps): priority 128
  8. 8.Step 8: Exit policy-map configuration: exit
  9. 9.Step 9: Apply the policy map to the outbound interface: interface GigabitEthernet0/0
  10. 10.Step 10: Attach the service policy: service-policy output QOS
Configuration
!
class-map match-any VOICE
 match dscp ef
!
policy-map QOS
 class VOICE
  priority 128
!
interface GigabitEthernet0/0
 service-policy output QOS
!

Verify: Use 'show policy-map interface GigabitEthernet0/0' to verify the policy is applied and voice traffic is being matched. Expected output shows the class VOICE with packet counts and priority queue statistics.

Watch out: Ensure the DSCP marking is applied upstream (e.g., on IP phones or at the ingress interface). If voice traffic arrives with a different DSCP value (e.g., CS5 instead of EF), the match will fail. Also, priority queue bandwidth should not exceed the interface bandwidth; otherwise, the policy may be rejected.

Police and Remark Traffic Based on DSCP

An ISP wants to limit traffic marked with DSCP AF41 (value 34) to 10 Mbps and remark excess traffic to DSCP 0 (best effort). This scenario demonstrates using match dscp in a class map for policing and marking.

Topology

ISP-Router(Gi0/0)---192.168.1.0/30---(Gi0/0)Customer-Router

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a class map named AF41-TRAFFIC: class-map match-any AF41-TRAFFIC
  3. 3.Step 3: Match DSCP AF41: match dscp af41
  4. 4.Step 4: Exit class-map configuration: exit
  5. 5.Step 5: Create a policy map named POLICE-AF41: policy-map POLICE-AF41
  6. 6.Step 6: Associate the class map: class AF41-TRAFFIC
  7. 7.Step 7: Police the traffic to 10 Mbps, conform action transmit, exceed action set-dscp-transmit 0: police 10000000 conform-action transmit exceed-action set-dscp-transmit 0
  8. 8.Step 8: Exit policy-map configuration: exit
  9. 9.Step 9: Apply the policy map to the interface: interface GigabitEthernet0/0
  10. 10.Step 10: Attach the service policy inbound: service-policy input POLICE-AF41
Configuration
!
class-map match-any AF41-TRAFFIC
 match dscp af41
!
policy-map POLICE-AF41
 class AF41-TRAFFIC
  police 10000000 conform-action transmit exceed-action set-dscp-transmit 0
!
interface GigabitEthernet0/0
 service-policy input POLICE-AF41
!

Verify: Use 'show policy-map interface GigabitEthernet0/0' to see the policer statistics. Expected output shows conformed and exceeded packet counts. Use 'show class-map' to verify the class map is configured.

Watch out: The police command uses bits per second (bps) for the rate. A common mistake is specifying the rate in kbps or Mbps without the correct number of zeros. Also, ensure the policy is applied inbound to police traffic before it enters the router; outbound policing is also possible but less common for this scenario.

Troubleshooting with This Command

When troubleshooting QoS classification with `match dscp`, the primary verification tool is `show policy-map interface [interface-name]`. This command displays per-class statistics, including the number of packets matched by each class. Healthy output shows increasing packet counts for the class that should be matching DSCP-marked traffic.

If the packet count remains zero, the classification is failing. First, verify that the DSCP value in the `match dscp` command matches the actual DSCP value in the packets. Use `show ip interface [interface-name]` to check if the interface is up and has traffic.

For deeper inspection, use `debug ip packet` (with caution in production) or an ACL to capture traffic and examine DSCP values. Alternatively, use `show access-lists` if an ACL is used for classification. Another common issue is that the class map uses `match-all` when it should use `match-any` (or vice versa).

For `match-all`, all match criteria must be true; for `match-any`, any one match is sufficient. If multiple `match dscp` statements are used, ensure the class-map type is appropriate. Also, check if the service policy is applied to the correct interface and direction (input or output).

Use `show running-config | section policy-map` to verify the policy map configuration. If the policy map is not attached, use `service-policy` command. Another symptom is that the policy map is attached but the class map is not matching due to incorrect DSCP values.

For example, if the network uses IP precedence marking (values 0-7), the DSCP field will have those values in the first 3 bits, but the actual DSCP value is the precedence multiplied by 8 (e.g., IP precedence 5 equals DSCP 40). Use `match ip precedence` instead if the traffic is marked with IP precedence. Additionally, verify that the DSCP marking is not being overwritten by another policy upstream.

Use `show policy-map interface` on upstream interfaces to see if marking or policing is altering DSCP. Finally, check for hardware limitations: on some platforms, QoS policies are handled in hardware and may not show per-packet statistics; use `show platform qos statistics` if available. Correlate with `show interface` for interface errors or drops.

If the policy is policing, check the conform and exceed counters. A step-by-step diagnostic flow: 1) Verify interface status and traffic flow. 2) Check class-map configuration. 3) Check policy-map configuration. 4) Verify service-policy attachment. 5) Monitor packet matches with `show policy-map interface`. 6) If no matches, capture traffic with an ACL or debug to confirm DSCP values. 7) Adjust match criteria accordingly.

CCNA Exam Tips

1.

CCNA exam tip: DSCP values are often tested with their decimal equivalents (e.g., EF=46, AF41=34).

2.

CCNA exam tip: Remember that 'match dscp' is used in class-map config mode, not globally.

3.

CCNA exam tip: You can match up to 8 DSCP values in a single match statement.

4.

CCNA exam tip: DSCP matching is case-insensitive (e.g., 'ef' or 'EF').

Common Mistakes

Mistake 1: Using 'match ip dscp' instead of 'match dscp' in class-map config mode.

Mistake 2: Forgetting to enter class-map configuration mode before using the command.

Mistake 3: Matching DSCP values that are not standard or mis-typing the value (e.g., 'af41' vs 'af4').

match dscp [value] vs policy-map [name]

These two commands are commonly confused because both are key components of Cisco QoS configuration, but they operate at different stages: 'match dscp' defines traffic classification criteria within a class map, while 'policy-map' aggregates multiple class maps and applies QoS actions like bandwidth allocation or queuing. Understanding their distinct roles is essential for building effective QoS policies.

Aspectmatch dscp [value]policy-map [name]
ScopePer-classification condition within a class mapEntire policy aggregating multiple class maps
Configuration ModeClass-map configuration modeGlobal configuration mode
PersistenceSaved as part of class-map definitionSaved as a separate policy-map definition
Typical UseIdentify traffic by DSCP for marking or queuingDefine actions (e.g., priority, bandwidth) for classified traffic

Use match dscp [value] when you need to classify traffic based on the DSCP field in the IP header within a class map.

Use policy-map [name] when you need to create or modify a QoS policy that applies actions (such as bandwidth guarantees or drop policies) to one or more class maps.

Platform Notes

In Cisco IOS-XE (e.g., CSR1000v, ISR 4000), the `match dscp` command syntax is identical to classic IOS. However, IOS-XE often supports additional DSCP keywords like `ef`, `af41`, etc., and the output of `show policy-map interface` may include more detailed statistics, such as queueing information. In NX-OS (e.g., Nexus 9000), the equivalent command is also `match dscp` but is configured under a class map in the QoS policy-map configuration mode.

NX-OS uses a different configuration hierarchy: first create a class map with `class-map type qos [match-any | match-all] <name>`, then use `match dscp <value>`. The policy map is created with `policy-map type qos <name>`. The `service-policy` command is applied to an interface under `interface <type> <slot/port>` with `service-policy type qos [input | output] <name>`.

In Cisco ASA, there is no direct `match dscp` command; instead, use `match dscp` in a class map for QoS (e.g., `class-map VOICE` then `match dscp ef`). ASA QoS is limited compared to IOS. In IOS-XR (e.g., ASR 9000), the command is `match dscp` under a class map, but the configuration is done in the QoS policy-map configuration mode similar to NX-OS.

The syntax is `class-map match-any <name>` then `match dscp <value>`. IOS-XR also supports DSCP keywords. For version differences: IOS 12.x and 15.x have the same syntax; IOS 16.x (IOS-XE) may have minor output differences.

Always verify the specific platform documentation. The command is available in all major IOS versions, but some older versions may not support all DSCP keywords (e.g., `af11` may not be recognized; use numeric value instead).

Related Commands

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

show class-map

Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions