show policy-map
Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.
Definition: show policy-map is a Cisco IOS privileged exec command. Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.
Overview
The 'show policy-map' command is a critical diagnostic tool in Cisco IOS that displays the configuration and statistics of all policy maps applied to interfaces. Policy maps are the core building blocks of Quality of Service (QoS) configurations, defining traffic classes and the actions to be applied to them, such as marking, policing, shaping, or queuing. This command is essential for verifying that QoS policies are correctly applied and for monitoring traffic class counters to ensure that traffic is being treated as intended. Without it, network engineers would be blind to whether their QoS policies are actually working, leading to potential performance issues like voice/video degradation or bandwidth starvation for critical applications.
The networking concept behind policy maps is the Modular QoS CLI (MQC) framework, which separates traffic classification (via class maps) from policy actions (via policy maps). A policy map binds one or more class maps to specific actions, and is then attached to an interface using the 'service-policy' command. The 'show policy-map' command reveals the entire hierarchy: which class maps are referenced, what actions are configured (e.g., bandwidth guarantees, priority queues, drop policies), and real-time counters showing how many packets matched each class, how many were dropped, and how much traffic was shaped or policed.
You would reach for this command over alternatives like 'show policy-map interface' when you need a global view of all policy maps configured on the device, not just those applied to interfaces. While 'show policy-map interface' provides per-interface statistics, 'show policy-map' shows the raw configuration and cumulative counters across all interfaces where the policy is applied. It is particularly useful during initial deployment to confirm that the policy map syntax is correct, or after changes to verify that modifications took effect. In troubleshooting, it helps isolate whether a policy is misconfigured (e.g., wrong match criteria) or if the hardware is failing to enforce it.
In the broader network troubleshooting workflow, 'show policy-map' is often used after 'show class-map' to verify classification, and before 'show policy-map interface' to drill into per-interface details. It is also commonly paired with 'show running-config | section policy-map' to compare the live configuration with the intended design. Important IOS behaviors to note: the output is buffered and may be truncated if the terminal length is not set to 0 (use 'terminal length 0' to see all output). The command requires privilege level 15 (Privileged EXEC mode) and does not modify the running configuration. In some IOS versions, the output includes a 'service-policy' section showing which interfaces the policy is applied to, but this is not always present; use 'show policy-map interface' for that binding information.
show policy-mapWhen to Use This Command
- Verify that a QoS service policy is correctly applied to an interface and check packet/byte counters for each class.
- Troubleshoot why certain traffic is not being matched or marked as expected.
- Monitor the effectiveness of a shaping or policing policy by observing conform/exceed actions.
- Audit multiple interfaces to ensure consistent QoS policy application across the network.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| policy-map-name | WORD | The name of a specific policy map to display. If omitted, all policy maps are shown. Common mistake: using the class-map name instead of the policy-map name, which yields no output. |
Command Examples
Basic show policy-map output
show policy-map Policy Map QOS_POLICY
Class VOICE
Average Rate Traffic Shaping
cir 256000 (bps)
police cir 128000 bc 4000 be 4000
conform-action transmit
exceed-action drop
Class VIDEO
Average Rate Traffic Shaping
cir 512000 (bps)
Class class-default
Average Rate Traffic Shaping
cir 1000000 (bps)
Line 1: Policy map name. Lines 2-6: Class VOICE with shaping to 256 kbps and policing at 128 kbps with conform/transmit and exceed/drop actions. Lines 7-9: Class VIDEO with shaping to 512 kbps. Lines 10-12: Default class with shaping to 1 Mbps.
Show policy-map interface for statistics
show policy-map interface gigabitethernet0/1 GigabitEthernet0/1
Service-policy output: QOS_POLICY
Class-map: VOICE (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip dscp ef (46)
police:
cir 128000 bps, bc 4000 bytes, be 4000 bytes
conformed 0 packets, 0 bytes; actions: transmit
exceeded 0 packets, 0 bytes; actions: drop
conformed 0 bps, exceed 0 bps
Class-map: VIDEO (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip dscp af41 (34)
queue size 0, queue limit 64 packets
(depth/ discard/ tail drops/ no buffer) 0/0/0/0
Average Rate Traffic Shaping
cir 512000 bps, bc 16000 bytes
shaped 0 packets, 0 bytes
drops 0
Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
queue size 0, queue limit 40 packets
(depth/ discard/ tail drops/ no buffer) 0/0/0/0
Average Rate Traffic Shaping
cir 1000000 bps, bc 31250 bytes
shaped 0 packets, 0 bytes
drops 0
Shows per-interface statistics. For each class: packet/byte counters, offered rate, match criteria, policing/shaping parameters, conform/exceed counters, queue depth and drops. Zero counters indicate no traffic yet.
Understanding the Output
The output lists all configured policy maps and their classes. For each class, it shows match criteria, QoS actions (shaping, policing, marking), and traffic statistics. Key fields: 'cir' (committed information rate), 'bc' (burst committed), 'be' (burst excess).
For policing, 'conformed' and 'exceeded' counters show how many packets met or exceeded the rate. For shaping, 'shaped' packets and 'drops' indicate traffic delayed or dropped due to shaping. Queue statistics (depth, limit, tail drops) help monitor congestion.
In a real network, increasing drop counters or queue depth may indicate insufficient bandwidth or misconfigured policies.
Configuration Scenarios
Verify QoS Policy for Voice Traffic on WAN Link
A network engineer needs to confirm that a policy map named 'VOICE-POLICY' is correctly classifying voice traffic (DSCP EF) and giving it strict priority queuing on a serial WAN interface.
Topology
R1(Gi0/0)---192.168.1.0/30---(Gi0/0)R2
R1(Se0/0/0)---10.0.0.0/30---(Se0/0/0)R3Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Display the policy map configuration: Router# show policy-map VOICE-POLICY
- 3.Step 3: Verify that the class 'VOICE' has priority level 1 and police rate 128000 bps.
- 4.Step 4: Check counters to see if any packets have been matched or dropped.
! Policy map configuration policy-map VOICE-POLICY class VOICE priority level 1 police cir 128000 conform-action transmit exceed-action drop class class-default fair-queue
Verify: Router# show policy-map VOICE-POLICY Policy Map VOICE-POLICY Class VOICE priority level 1 police cir 128000 bc 4000 conform-action transmit exceed-action drop Class class-default fair-queue (output counters show packets matched, bytes, etc.)
Watch out: If the policy map is not applied to any interface, the counters will show zero packets. Always check 'show policy-map interface' to confirm the binding.
Troubleshoot Traffic Shaping on a Cable Interface
A user reports slow upload speeds. The engineer suspects the shaping rate in policy map 'SHAPE-1M' is too low or not being applied to the cable interface.
Topology
R4(Gi0/0)---192.168.2.0/24---Cable Modem
R4(Cable0/0/0)---10.10.10.0/30---ISPSteps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: View the policy map: Router# show policy-map SHAPE-1M
- 3.Step 3: Check the shape average rate (e.g., 1000000 bps).
- 4.Step 4: Verify that the policy is applied to the cable interface using 'show policy-map interface Cable0/0/0'.
! Policy map for shaping policy-map SHAPE-1M class class-default shape average 1000000
Verify: Router# show policy-map SHAPE-1M Policy Map SHAPE-1M Class class-default shape average 1000000 (bits/sec) (no counters shown here; use 'show policy-map interface' for statistics)
Watch out: Shaping counters are only visible under 'show policy-map interface', not under 'show policy-map'. Engineers often mistakenly look here for byte counts.
Troubleshooting with This Command
When troubleshooting QoS issues, 'show policy-map' is your first stop to verify the policy definition. Healthy output shows the correct class maps, actions (priority, bandwidth, shape, police), and parameters like CIR, burst sizes, and queue limits. Problem indicators include missing classes, incorrect actions (e.g., 'bandwidth' instead of 'priority' for voice), or syntax errors that prevent the policy from being applied. Focus on the class names and action keywords: for example, if a 'priority' command is missing the 'level' keyword, the policy may fail to apply. Also check for 'police' or 'shape' rates that are too low or too high relative to the interface bandwidth.
Common symptoms this command helps diagnose include: voice quality issues (check if voice class has priority and proper police rate), data application slowdowns (check if bandwidth allocation is too low), and unexpected drops (check if police exceed-action is drop and counters show many exceeded packets). The step-by-step diagnostic flow: 1) Run 'show policy-map' to confirm the policy map configuration matches the design. 2) If the policy looks correct, run 'show policy-map interface' to see per-interface statistics. 3) Look at the 'offered rate' vs 'drop rate' for each class. 4) If drops are high, check the 'shape average' or 'police cir' values. 5) Correlate with 'show interface' for output drops and 'show queueing' for queue depths.
Correlate this command's output with 'show class-map' to ensure classification matches your ACLs or NBAR. For example, if 'show policy-map' shows a class 'VOICE' but 'show policy-map interface' shows zero packets matched, the class-map may have a wrong match statement. Also use 'debug policy-map' (with caution) to see real-time packet matching. In summary, 'show policy-map' is the foundation for QoS verification; without it, you cannot be sure your policies are configured as intended.
CCNA Exam Tips
CCNA exam may ask to interpret output to determine if a class is matching traffic correctly (look at packet counters).
Know the difference between shaping (queues and delays) and policing (drops or marks down).
Be able to identify the default class (class-default) and its match-any condition.
Remember that 'show policy-map interface' provides statistics, while 'show policy-map' only shows configuration.
Common Mistakes
Confusing 'show policy-map' (configuration only) with 'show policy-map interface' (statistics).
Assuming zero counters mean the policy is not applied; it may just have no matching traffic.
Misinterpreting 'conformed' and 'exceeded' counters: exceeded packets are dropped or marked, not necessarily bad if within burst allowance.
show policy-map vs show policy-map interface
These two commands are commonly confused because both display policy-map information, but they operate at different granularities—one shows all configured policy maps, the other shows the active policy on an interface along with real-time statistics.
| Aspect | show policy-map | show policy-map interface |
|---|---|---|
| Scope | All policy maps configured (global) | A specific interface's applied policy |
| Output detail | Configuration of policy map classes, no per-packet stats | Per-class counters (packets, bytes, actions) |
| Typical use | Verify overall QoS policy configuration | Troubleshoot traffic matching and actions on an interface |
| Interface requirement | None (global) | Requires interface specification (e.g., GigabitEthernet0/1) |
| Statistics | Shows only if applied to interface (summary) | Shows detailed live counters |
| Common syntax | show policy-map [map-name] | show policy-map interface [interface] |
Use show policy-map when you need to review the configuration of all policy maps or a specific policy map definition.
Use show policy-map interface when you need to verify and troubleshoot the QoS policy actively applied on a specific interface, including per-class traffic statistics.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the 'show policy-map' command syntax and output are largely identical to classic IOS, but the output may include additional fields like 'queue-limit' and 'random-detect' for WRED. The NX-OS equivalent is 'show policy-map [name]' but note that NX-OS uses a different QoS CLI structure; policy maps are defined under 'policy-map type qos' and the output includes 'type qos' in the header. For ASA firewalls, the equivalent is 'show service-policy' or 'show policy-map' (ASA 9.x+), but ASA uses 'policy-map' for inspection and QoS, so the command exists but with different syntax (e.g., 'policy-map type inspect dns').
IOS-XR uses 'show policy-map [name]' as well, but the output format is different, often showing 'policy-map' under a 'type' such as 'qos' or 'traffic'. Between IOS versions, 12.x and 15.x have similar output, but 16.x (IOS-XE) may include 'service-policy' bindings in the output. Always check the specific platform documentation for exact field names.
Related Commands
show class-map
Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.
show policy-map interface
Displays the current QoS policy applied to an interface, including per-class statistics such as packets matched, bytes, and actions taken, used to verify and troubleshoot QoS configurations.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions