show mls qos
Verify QoS trust boundaries, DSCP-to-queue mappings, and queue statistics on Catalyst Layer 2/3 switches.
Definition: show mls qos is a Cisco IOS privileged exec command. Displays the MLS (Multi-Layer Switching) QoS configuration on Catalyst switches including trust state, DSCP maps, queuing settings, and per-interface QoS statistics.
Overview
The 'show mls qos' command is a critical diagnostic tool for Cisco switches that displays the current Quality of Service (QoS) configuration and statistics. QoS is essential for managing network bandwidth, prioritizing traffic, and ensuring that critical applications like voice and video receive the necessary resources. This command provides a comprehensive view of the QoS policy applied globally or per interface, including classification, marking, policing, and queuing details.
Network engineers use this command to verify that QoS policies are correctly applied, to monitor traffic behavior, and to troubleshoot issues such as packet drops or unexpected latency. Unlike 'show policy-map interface', which focuses on service policies, 'show mls qos' gives a broader perspective on the switch's QoS hardware resources and overall status. It is particularly useful in environments where multiple QoS features are active, as it aggregates information from various components.
The command requires privileged EXEC mode (enable) and does not alter the running configuration. Output can be extensive, so it is often filtered with modifiers like '| include' or '| section'. Understanding the output helps engineers ensure that QoS policies are functioning as intended and that the switch's hardware resources are not oversubscribed.
show mls qos [interface <interface-id> | maps | queue-sets | input-queue]When to Use This Command
- Confirm a switch port is set to trust DSCP markings from a connected IP phone
- View DSCP-to-CoS or DSCP-to-DSCP rewrite maps configured on the switch
- Check per-interface queue statistics for drops and congestion
- Verify mls qos is globally enabled (required before per-port QoS takes effect)
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface | interface-id | Specifies a particular interface (e.g., GigabitEthernet0/1) to display QoS information for that interface only. If omitted, the command shows global QoS settings and statistics for all interfaces. Common mistake: using an invalid interface name or forgetting to specify the interface type (e.g., 'Gi0/1' instead of 'GigabitEthernet0/1'). |
| statistics | statistics | Displays detailed QoS statistics, including packet counts for different classes, drop counts, and byte counts. This keyword is useful for troubleshooting traffic patterns and verifying that policies are being applied correctly. Without this keyword, the output shows configuration and summary information. |
| maps | maps | Shows the QoS maps (class maps and policy maps) that are configured on the switch. This is useful for reviewing the classification and policy definitions without displaying per-interface statistics. Common mistake: confusing this with 'show class-map' or 'show policy-map' which provide more detailed definitions. |
| qos | qos | Displays the global QoS configuration, including the trust state and default CoS values. This is a subset of the full output and is useful for a quick check of the global QoS settings. Common mistake: assuming this shows per-interface details. |
Command Examples
Check global MLS QoS status
Switch# show mls qos QoS is enabled QoS ip packet dscp rewrite is enabled
Check interface trust state
Switch# show mls qos interface GigabitEthernet1/0/1 GigabitEthernet1/0/1 Attach policy : Trust state: trust dscp Default DSCP: 0 QoS Set : dscp dscp table dscp2dscp
Understanding the Output
Trust state: trust dscp = port honours DSCP values from connected devices. trust cos = port honours CoS (802.1p) markings. untrusted (default) = all incoming DSCP/CoS is reset to 0. QoS is enabled must appear at global level or per-interface QoS has no effect.
Configuration Scenarios
Verify Global QoS Trust Setting on a Cisco Switch
A network administrator needs to confirm that the switch is trusting the DSCP markings from incoming traffic to preserve QoS priorities across the network.
Topology
Switch1(Gi0/1)---PC1 (DSCP 46 VoIP traffic)Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Display global QoS configuration: Switch# show mls qos
- 3.Step 3: Look for the line 'QoS is enabled globally' and 'Trust state: trust dscp' to confirm the trust setting.
! No configuration needed for verification; command is show-only
Verify: Switch# show mls qos QoS is enabled globally ... Trust state: trust dscp ...
Watch out: If the switch is in 'trust cos' mode, DSCP markings from PCs will be ignored. Ensure the trust state matches the expected marking method.
Troubleshoot QoS Policing Drops on an Interface
Voice traffic is experiencing jitter, and the network engineer suspects that a policer is dropping packets on the uplink interface.
Topology
Switch1(Gi0/1)---(Gi0/2)Router (WAN)Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Display QoS statistics for the uplink interface: Switch# show mls qos interface GigabitEthernet0/2 statistics
- 3.Step 3: Examine the 'Policer' section for 'drop' counts. High drop counts indicate that traffic is exceeding the policed rate.
! Example policer configuration on Gi0/2: interface GigabitEthernet0/2 service-policy input QOS-POLICY
Verify: Switch# show mls qos interface GigabitEthernet0/2 statistics ... Policer: conformed: 10000 packets, 5000000 bytes exceeded: 500 packets, 250000 bytes violated: 200 packets, 100000 bytes ...
Watch out: Policing drops may be due to burst size misconfiguration. Check the 'bc' and 'be' values in the policy map. Also, ensure that the interface speed and duplex settings match the policer rate.
Troubleshooting with This Command
When troubleshooting QoS issues, the 'show mls qos' command is invaluable for identifying misconfigurations and verifying that policies are applied correctly. A healthy output typically shows 'QoS is enabled globally' and per-interface trust states that match the intended policy. For example, if you expect DSCP trust, you should see 'Trust state: trust dscp'.
If you see 'Trust state: not trusted' or 'Trust state: trust cos', it indicates a mismatch. Key fields to focus on include the 'QoS is enabled globally' line, the 'Trust state' for each interface, and the 'Policer' statistics when policing is configured. High 'exceeded' or 'violated' counts in the policer section suggest that traffic is being dropped, which can cause performance issues for critical applications.
A step-by-step diagnostic flow would be: 1) Check global QoS status with 'show mls qos' to ensure QoS is enabled. 2) For a specific interface, use 'show mls qos interface <interface>' to verify the trust state and any attached policy maps. 3) If policing is used, examine 'show mls qos interface <interface> statistics' to see drop counts. 4) Correlate with 'show policy-map interface <interface>' to see per-class statistics and compare conformed vs exceeded packets. 5) Use 'show mls qos maps' to review the classification maps if traffic is not being matched correctly. Common symptoms that this command helps diagnose include: all traffic being treated as best-effort (trust state incorrect), voice quality issues (policing drops on voice traffic), and unexpected bandwidth usage (policer not shaping as expected). By correlating the output with 'show interface' for interface errors and 'debug mls qos' for real-time packet marking, engineers can pinpoint the root cause of QoS problems.
Remember that 'show mls qos' shows hardware-level statistics, so it reflects actual packet processing, unlike 'show policy-map' which may show software counters on some platforms.
CCNA Exam Tips
CCNA exam: know the difference between trust dscp (used for IP phones and QoS-aware devices) and untrusted ports
The global command mls qos must be enabled on Catalyst switches before any port-level QoS works. show mls qos interface confirms the effective trust state per port
Common Mistakes
Configuring mls qos trust dscp on a port without first enabling mls qos globally — has no effect
Trusting CoS on a port connected directly to a PC — end users can manually set CoS and game QoS
Always trust only at the perimeter (where you control the device)
show mls qos vs show interfaces
Both 'show mls qos' and 'show interfaces' can display queue-related information, but they serve distinct purposes. 'show mls qos' focuses on the configured QoS policy (trust, maps, queuing) while 'show interfaces' provides operational Layer1/2 stats including queue drops. They are often used together to correlate QoS configuration with actual interface performance.
| Aspect | show mls qos | show interfaces |
|---|---|---|
| Primary Focus | MLS QoS configuration and maps | Interface Layer1/Layer2 operational status and errors |
| Scope | Global and per-interface QoS policies | All physical and logical interfaces |
| Configuration vs. Operational | Displays configured QoS parameters (trust, DSCP maps) | Displays real-time operational stats and counters |
| Queue Information | Per-interface queueing settings and thresholds | Per-interface output queue drops and sizes |
| Typical Use | Verifying QoS policy application and mapping consistency | Troubleshooting link issues, errors, and throughput |
Use show mls qos when verifying QoS policy application, trust state, or DSCP/CoS mappings on a switch.
Use show interfaces when troubleshooting link-level issues like errors, duplex mismatches, or interface reset counts.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850), the 'show mls qos' command is available but the output format may differ slightly, with additional fields like 'QoS is enabled' and 'Trust state' appearing under a different hierarchy. The equivalent command in NX-OS (e.g., Nexus 9000) is 'show policy-map interface' or 'show queuing interface', as NX-OS does not use the 'mls' keyword. For ASA firewalls, QoS is managed via 'show service-policy' and 'show priority-queue', not 'show mls qos'.
In IOS-XR, the command does not exist; instead, use 'show policy-map interface' or 'show qos interface'. Behavior differences between IOS versions: In older IOS 12.x, 'show mls qos' might not show per-interface statistics without the 'statistics' keyword, while IOS 15.x and 16.x provide more detailed output by default. Also, on some platforms, the command may require 'show mls qos ip' for IP-specific QoS information.
Always check the specific platform documentation, as the command may be deprecated in newer models in favor of 'show policy-map' or 'show platform qos'.
Related Commands
service-policy
Attaches a QoS policy map to an interface in the input or output direction, activating traffic classification, marking, queuing, policing, and shaping defined in the policy map.
show interfaces
Displays detailed Layer 1 and Layer 2 statistics for all interfaces or a specific interface: line protocol state, hardware type, MAC address, MTU, bandwidth, duplex, speed, input/output rates, error counters, and queue statistics.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions