In which configuration mode is show class-map used?

The show class-map command is entered in Privileged EXEC mode on Cisco IOS devices.

QoSPrivileged EXEC

show class-map

Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.

Definition: show class-map is a Cisco IOS privileged exec command. Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.

Overview

The 'show class-map' command is a vital diagnostic tool in Cisco IOS that displays the configuration and match criteria of all class maps or a specific class map. Class maps are used in Quality of Service (QoS) policies to classify network traffic based on various criteria such as IP addresses, protocols, DSCP values, or access lists. This command is essential for verifying that classification rules are correctly defined before applying them to a policy map.

It allows network engineers to inspect the match statements within a class map, ensuring that traffic is being classified as intended. Without proper classification, QoS policies may not function correctly, leading to suboptimal performance for critical applications. The command is typically used during the configuration phase to validate class map definitions, or during troubleshooting to identify why certain traffic is not being treated as expected.

Unlike 'show policy-map' which shows the entire policy including actions, 'show class-map' focuses solely on the classification criteria. It is also useful for comparing the configured class maps against the running configuration to detect discrepancies. The output is buffered and can be filtered using the 'include', 'begin', or 'section' modifiers.

The command requires privileged EXEC mode (enable) and does not affect the running configuration. Understanding the output of 'show class-map' is fundamental for CCNA and CCNP candidates as it underpins QoS deployment and troubleshooting.

Syntax·Privileged EXEC

show class-map

When to Use This Command

Verify that a class map matches the intended traffic (e.g., HTTP traffic) after configuration.
Troubleshoot why QoS policies are not classifying traffic correctly.
Audit existing class maps before modifying or deleting them.
Check the match type (match-all vs match-any) and match criteria for a specific class map.

Parameters

Parameter	Syntax	Required	Description
class-map-name	WORD	Optional	The name of a specific class map to display. If omitted, all class maps are shown. The name is case-sensitive and must match exactly. Common mistakes include typos or incorrect case, which result in no output or an error.

Command Examples

Display all class maps

show class-map

 Class Map match-any HTTP_TRAFFIC (id 1)
   Match protocol http

 Class Map match-all VOICE_TRAFFIC (id 2)
   Match ip dscp ef

 Class Map match-all CRITICAL_DATA (id 3)
   Match access-group name CRITICAL_ACL

Line 1: Class map name 'HTTP_TRAFFIC' with match-any logic (matches if any condition is true), internal ID 1. Line 2: Match condition - protocol http. Line 3: Class map 'VOICE_TRAFFIC' with match-all logic (all conditions must match), ID 2. Line 4: Match condition - IP DSCP value EF. Line 5: Class map 'CRITICAL_DATA' with match-all logic, ID 3. Line 6: Match condition - named access-list CRITICAL_ACL.

Display a specific class map

show class-map VOICE_TRAFFIC

 Class Map match-all VOICE_TRAFFIC (id 2)
   Match ip dscp ef

Shows only the class map named VOICE_TRAFFIC. The output confirms it uses match-all logic and matches on DSCP EF (Expedited Forwarding).

Understanding the Output

The output lists each class map with its name, match type (match-all or match-any), and internal ID. Below the header, each match condition is shown. 'Match-all' means all conditions must be true for a packet to match; 'match-any' means any one condition is sufficient.

The match criteria can include protocol, DSCP, IP precedence, access-group, CoS, etc. In a real network, verify that the class maps are correctly defined before applying them in a policy map. A missing or incorrect class map can cause traffic to be misclassified, leading to QoS policies not working as intended.

Configuration Scenarios

Verify a class map that matches VoIP traffic by DSCP

A network administrator needs to ensure that a class map named VOIP is correctly configured to match traffic with DSCP EF (46) before applying it to a policy map for priority queuing.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)R2

Steps

1.Step 1: Enter privileged EXEC mode: Router> enable
2.Step 2: Display the specific class map: Router# show class-map VOIP

Configuration

! Configuration of class-map VOIP
Router(config)# class-map match-all VOIP
Router(config-cmap)# match ip dscp ef
Router(config-cmap)# exit

Verify: Router# show class-map VOIP Class Map match-all VOIP (id 1) Match ip dscp ef (46)

Watch out: If the class map uses 'match-all' but multiple match statements are intended, only one match is required. Ensure the match type (match-all vs match-any) aligns with the desired logic.

List all class maps to audit QoS classification

During a network audit, the engineer needs to review all configured class maps to ensure no outdated or incorrect classification rules exist that could impact traffic prioritization.

Topology

R1(Gi0/0)---10.10.10.0/24---(Gi0/0)R2

Steps

1.Step 1: Enter privileged EXEC mode: Router> enable
2.Step 2: Display all class maps: Router# show class-map

Configuration

! Sample class maps configured
Router(config)# class-map match-all HTTP
Router(config-cmap)# match protocol http
Router(config-cmap)# exit
Router(config)# class-map match-any CRITICAL
Router(config-cmap)# match ip dscp af21
Router(config-cmap)# match ip dscp af31
Router(config-cmap)# exit

Verify: Router# show class-map Class Map match-all HTTP (id 2) Match protocol http Class Map match-any CRITICAL (id 3) Match ip dscp af21 (18) Match ip dscp af31 (26) Class Map match-all class-default (id 0) Match any

Watch out: The default class 'class-default' always exists and matches any traffic not matched by other classes. Do not delete or modify it inadvertently.

Troubleshooting with This Command

When troubleshooting QoS issues, 'show class-map' is often the first step to verify that classification rules are correctly defined. A healthy output shows each class map with its match type (match-all or match-any) and the specific match criteria. For example, a class map named 'VOIP' should display 'Match ip dscp ef (46)'.

If the output shows no class maps (except class-default), it indicates that no custom class maps are configured, which may be intentional or a misconfiguration. Problem indicators include missing match statements, incorrect match types, or class maps that do not appear despite being configured. Focus on the 'match' lines: if a class map is intended to match multiple conditions but uses 'match-all', all conditions must be true; if it uses 'match-any', any single condition suffices.

Common symptoms include traffic not being classified as expected, leading to improper QoS treatment. For instance, if voice traffic is not being prioritized, check that the DSCP value matches the class map. Use 'show class-map' to confirm the match criteria, then correlate with 'show policy-map interface' to see if the class map is referenced and if traffic matches.

A step-by-step diagnostic flow: 1) Identify the class map name from the policy map using 'show policy-map'. 2) Run 'show class-map <name>' to inspect its match criteria. 3) Verify that the traffic in question meets the criteria (e.g., using 'show ip access-lists' if matching on ACL). 4) If the class map is correct, check the policy map actions. Correlate with 'show running-config | section class-map' to see the configuration. Also, use 'debug condition' to monitor classification events.

Remember that class maps are case-sensitive and must be referenced exactly in policy maps. If a class map is missing, it may have been deleted or never created. The output of 'show class-map' is static and reflects the current running configuration; any changes require re-verification.

CCNA Exam Tips

CCNA exam tip: Remember that 'match-all' is the default if not specified; 'match-any' must be explicitly configured.

CCNA exam tip: Class maps are used in policy maps to define traffic classes; know the difference between class maps and policy maps.

CCNA exam tip: The 'show class-map' command does not show which policy maps reference the class map; use 'show policy-map' for that.

CCNA exam tip: You can match on multiple criteria; for example, match-all with both DSCP and access-group requires both to match.

Common Mistakes

Mistake: Forgetting to specify match-any when multiple match criteria should be ORed; default is match-all which ANDs them.

Mistake: Using 'match protocol http' without ensuring NBAR is enabled; otherwise the match may not work.

Mistake: Deleting a class map that is referenced by a policy map, causing the policy to fail.

show class-map vs show policy-map

These commands are commonly confused because both are used for QoS verification in Cisco IOS, but they operate at different layers: class-map defines traffic classification rules, while policy-map defines the actions (policing, shaping, marking) applied to those classes. Understanding their distinct outputs is critical for accurate QoS troubleshooting.

Aspect	show class-map	show policy-map
Scope	Shows class-map definitions and match criteria	Shows policy-map definitions and service policies per interface
Output Focus	Lists configured class names, match statements, and match type	Displays classes within a policy, configured actions, and per-class counters
Statistics	No statistics displayed	Shows packet/byte counters, drop counts, and policing/shaping statistics
Configuration vs Operational	Pure configuration view (no operational data)	Both configuration (if no interface specified) and operational data (with interface)
Typical Use Case	Verify classification logic before applying a policy map	Monitor traffic class performance and verify actions after policy is applied

Use show class-map when you need to verify the match criteria of traffic classes or confirm that a class-map is correctly defined before attaching it to a policy-map.

Use show policy-map when you need to verify the actions applied to traffic classes, check per-class packet/byte counters, or troubleshoot QoS policy effectiveness on an interface.

Platform Notes

In IOS-XE, the 'show class-map' command behaves identically to classic IOS, with the same syntax and output format. However, in NX-OS (Cisco Nexus switches), the equivalent command is 'show class-map' as well, but the output format differs slightly: it displays class maps under the 'type qos' hierarchy if using MQC. For example, 'show class-map type qos' lists QoS class maps.

On ASA firewalls, the command is 'show class-map' and works similarly for modular policy framework (MPF). There are no significant differences between IOS versions 12.x, 15.x, and 16.x for this command, though newer versions may support additional match criteria (e.g., match on application). In IOS-XR, the command is 'show class-map' but the output is more verbose and includes references to the 'policy-map' type.

Always verify the specific platform documentation, as syntax variations exist (e.g., 'match dscp' vs 'match ip dscp').

Related Commands

show policy-map

Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.

show policy-map interface

Displays the current QoS policy applied to an interface, including per-class statistics such as packets matched, bytes, and actions taken, used to verify and troubleshoot QoS configurations.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions