QoS Marking and Classification

Quality of Service (QoS) marking is the process of setting bits in a packet's header to indicate its traffic class. Classification is the act of identifying packets based on criteria (like source IP, DSCP value, or application) and assigning them to a class. Marking and classification are the foundation of any QoS policy: you can't prioritize what you haven't identified and tagged.

On the CCNA 200-301 exam, you need to know two primary marking fields: - Layer 2: CoS (Class of Service) — 3 bits in the 802.1Q tag, used in switched networks. Values 0-7 (0 best effort, 5 voice, 7 network control). - Layer 3: DSCP (Differentiated Services Code Point) — 6 bits in the IP header ToS byte. Values 0-63, but common ones include EF (46) for voice, AF41 (34) for video, and CS0 (0) for best effort.

Also important: IP Precedence (3 bits, values 0-7) is the legacy predecessor to DSCP. Modern networks use DSCP, but you may still see IP Precedence on exam questions.

When a packet is created by an application, the operating system may set the DSCP value (e.g., VoIP phones set EF). As the packet traverses the network, switches and routers can read and possibly change the marking. The marking is stored in: - IP header: ToS byte (DSCP uses 6 bits, ECN uses 2 bits) - Ethernet header: 802.1Q tag (CoS uses 3 bits)

On a trunk link, both CoS and DSCP can be present. Cisco switches can map between CoS and DSCP using trust boundaries. The trust boundary is the point where the network accepts or overrides the marking. Typically, we trust markings from known devices (like IP phones) and re-mark traffic from untrusted sources (like PCs).

By default, most Cisco switch ports are untrusted — they set the CoS to 0 for all incoming frames. To trust markings, you configure:

interface GigabitEthernet0/1
 mls qos trust cos

Or for DSCP:

interface GigabitEthernet0/1
 mls qos trust dscp

If you trust DSCP, the switch copies the DSCP to the internal QoS tag. If you trust CoS, the switch uses the CoS value.

Cisco's standard way to classify and mark traffic is the Modular QoS CLI (MQC). The three steps: 1. Class map — Defines traffic match criteria. 2. Policy map — Defines actions (mark, queue, police) for each class. 3. Service policy — Applies the policy to an interface.

Example: Mark VoIP traffic with DSCP EF:

class-map match-any VOIP
 match ip dscp ef
!
policy-map MARK-VOIP
 class VOIP
  set dscp ef
!
interface GigabitEthernet0/1
 service-policy input MARK-VOIP

To see the classification and marking configuration:

show class-map
show policy-map
show policy-map interface GigabitEthernet0/1

Example output:

Router# show policy-map interface GigabitEthernet0/1
 GigabitEthernet0/1

  Service-policy input: MARK-VOIP

    Class-map: VOIP (match-any)
      5 packets, 500 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      QoS Set
        dscp ef
          Packets marked 5

Marking alone does nothing; it must be combined with a queuing strategy (like LLQ, CBWFQ) or policing/shaping. The marking determines which queue a packet goes into. For example, a policy that puts DSCP EF into a priority queue:

policy-map QUEUE
 class VOIP
  priority 1000
 class class-default
  fair-queue
!
interface Serial0/0/0
 service-policy output QUEUE

On the CCNA exam, you may be asked to identify the correct marking for a given application. Memorize these:

Layer 2 marking (CoS) is only relevant within a switched domain. When a packet leaves a router, the CoS is typically stripped unless you're using 802.1Q trunking. Layer 3 marking (DSCP) survives across routers until the IP header is rewritten. So for end-to-end QoS, DSCP is preferred. However, in a campus network, CoS is often used between switches, and the switch maps CoS to DSCP at the Layer 3 boundary.

A company deploys Cisco IP phones. The phones mark voice RTP traffic with DSCP EF and signaling with CS3. The switch ports are configured to trust CoS from the phone (via the 'mls qos trust cos' command). The access switch then maps CoS 5 to DSCP EF and CoS 3 to CS3. At the distribution layer, a service policy marks any traffic from untrusted PCs to DSCP 0. This ensures that voice traffic gets priority across the network. Without this marking, during congestion, voice packets would be dropped equally with data, causing jitter and poor call quality.

In a data center, storage traffic (iSCSI) and backup traffic compete for bandwidth. The storage team marks iSCSI with DSCP AF41 (34) and backup with AF11 (10). The network team configures a policy that guarantees minimum bandwidth for AF41 and limits AF11 to 1 Gbps. This prevents backups from saturating the link and causing storage timeouts. Misconfiguration could happen if backup traffic is marked higher than storage, causing storage performance degradation.

At the internet edge, the router marks all inbound traffic based on source IP (e.g., executive VPN traffic gets DSCP AF31, guest traffic gets DF). The ISP may honor these markings (if you pay for QoS) or ignore them. Inside the enterprise, the markings are used to prioritize traffic over the WAN link. If the markings are not applied correctly, critical business traffic might be dropped during congestion. Scale consideration: marking policies should be simple to avoid CPU overload; use hardware offload where possible.