Quality of Service is a set of technologies that enables a network to treat different types of traffic differently, giving priority to real-time applications like voice and video calls over less delay-sensitive data such as file downloads or email. Without QoS, a busy link becomes a free-for-all where critical traffic can be delayed, jittery, or dropped. For the 350-401 ENCOR exam, you must configure and verify classification, marking, and queuing on Cisco devices – the building blocks that keep business communication reliable even when the network is under pressure.
Jump to a section
A simple way to picture QoS and Network Performance Management
A hospital emergency department’s triage desk is the nerve centre that classifies incoming patients into severity categories, ensuring that life-threatening conditions receive immediate attention while minor ailments wait. The triage nurse inspects each arrival, checking symptoms and vital signs – this is classification. A red wristband is wrapped around a critical patient’s arm, instantly communicating priority to every corridor and specialist en route – that is marking. The patient is then directed to one of several queues: a resuscitation bay for the critically ill, a high-dependency unit for the seriously injured, or the general waiting room for sprains and coughs – this is queuing. Meanwhile, the hospital’s management dashboard tracks average wait times, bed occupancy, and resource usage, raising alarms if a queue grows too long – that is performance monitoring. Without triage, a heart-attack victim could be stuck behind someone with a stubbed toe. In exactly the same way, a network without Quality of Service would force a video call to fight for bandwidth with a software download, ruining the call.
Quality of Service (QoS) is not about making a network faster; it is about making a network fairer and more predictable when there is not enough bandwidth for everything at once. The central idea is that you can decide which packets deserve immediate treatment and which can wait. The process is broken into three major stages: classification, marking, and queuing (also called congestion management).
Classification is the act of inspecting a packet and deciding what type of traffic it carries. A router can look at many fields: the source and destination IP address, the TCP or UDP port number, the protocol number, or even the application signature using a feature called Network Based Application Recognition (NBAR). For example, a packet with destination port 5060 might be SIP voice signalling, and a packet on port 80 could be web traffic. The router groups similar traffic into a class.
Marking is the next step. Once classified, the packet is stamped with a priority value so that every hop along the path can treat it consistently without needing to deep-inspect again. The most common marking field is the Differentiated Services Code Point (DSCP), a 6-bit field inside the IP header that can hold values from 0 to 63. Common DSCP values include:
EF (Expedited Forwarding), decimal 46, for real-time voice traffic.
AF41 (Assured Forwarding class 4, low drop), decimal 34, for interactive video.
AF21 (Assured Forwarding class 2, low drop), decimal 18, for critical data.
BE (Best Effort), decimal 0, for everything else.
Marking is also possible at Layer 2 using the Class of Service (CoS) field in an 802.1Q VLAN tag, which has only 3 bits (values 0 to 7).
Queuing, or congestion management, takes over when an interface’s transmit ring is full – that is, when packets arrive faster than they can be sent out. Packets are placed into memory queues, and a scheduler decides which queue to service next. Cisco routers offer several algorithms:
First-In-First-Out (FIFO): a single queue; the first packet in is the first out, with no regard for priority.
Weighted Fair Queuing (WFQ): automatically divides bandwidth among all conversations (flows) to prevent one bulk transfer from starving interactive sessions.
Class-Based Weighted Fair Queuing (CBWFQ): lets the administrator define a queue for each traffic class and assign a minimum bandwidth guarantee to that class.
Low Latency Queuing (LLQ): adds a strict priority queue to CBWFQ; traffic in the priority queue is serviced as soon as it arrives, up to a policed limit, making it ideal for voice.
Cisco implements QoS configuration using the Modular QoS CLI (MQC), which has three parts:
Class map: defines which traffic belongs to a class (the classification).
Policy map: defines what action to take for each class (marking, policing, queuing).
Service policy: attaches the policy map to an interface, either inbound or outbound.
For example, a policy map might mark VoIP packets with DSCP EF, then on the outbound direction of a WAN interface, assign 30% of the link’s bandwidth to a priority queue for that EF class, 40% to a bandwidth queue for video AF41, and let the remaining traffic share the rest.
Beyond queuing, two other traffic conditioning tools are policing and shaping. Policing monitors a traffic rate and drops or re-marks any packets that exceed the configured rate; it introduces no additional delay. Shaping buffers excess traffic and releases it at a steady rate, smoothing bursts but adding latency. Policing is typically used at network ingress, shaping at egress.
Performance monitoring gives you the data to decide whether QoS is working. Tools include:
NetFlow: collects metadata about every flow (source, destination, protocol, bytes transferred, etc.) and exports it to a collector for analysis.
SNMP (Simple Network Management Protocol): polls device counters such as interface utilisation, queue drops, and CPU load.
IP SLA: sends synthetic probes (ICMP echo, UDP jitter, HTTP requests) to measure end-to-end latency, jitter, and packet loss.
Together, these mechanisms let you classify, mark, queue, and verify traffic treatment across an enterprise network.
Identify Traffic Classes
Use a class-map with match statements to categorise traffic. For example, match voice by DSCP EF, video by DSCP AF41, and critical data by an access list matching server IP addresses. This step defines what the network cares about.
Build a Policy Map with Queuing Actions
Create a policy-map and associate each class with a queuing action. Give voice the `priority` command (LLQ strict priority), video `bandwidth percent`, and leave class-default with `fair-queue`. This defines how bandwidth is divided under congestion.
Attach the Policy to an Interface in the Outbound Direction
Apply the service policy with `service-policy output POLICY-NAME` on the WAN interface. Queuing only operates in the output direction, so attaching it inbound would not control transmission queues.
Verify Queue Statistics
Run `show policy-map interface` to inspect per-class packet counts, bytes, and drops. A healthy policy shows zero drops in the priority queue and evenly distributed bandwidth according to the configured percentages.
Monitor Network Performance Over Time
Configure IP SLA probes to measure jitter and latency to critical servers, and set up SNMP polling of interface utilisation. Correlate this data with queue drops to proactively adjust bandwidth percentages before users complain.
An IT engineer at a mid-sized company is tasked with ensuring that IP telephony and Zoom video calls perform flawlessly even when the 100 Mbps Internet link is saturated with backups and software updates. They decide to implement QoS on the edge router facing the ISP.
First, they define traffic classes. Voice traffic is identified by its DSCP value of EF, which the IP phones already set. Video conferencing uses DSCP AF41. To be extra cautious, a class map also matches UDP ports 16384-32767, the dynamic range often used by voice and video packets. A separate class is created for critical database traffic based on TCP port 1521 (Oracle), and all remaining traffic falls into the class-default.
Next, they build a policy map called WAN-EDGE. Inside the voice class, they configure priority percent 20, which creates a strict priority queue policed to 20 Mbps. Under the video class, they set bandwidth percent 40, guaranteeing 40 Mbps from the remaining bandwidth. The database class gets bandwidth percent 20, and class-default receives fair-queue. The policy also remarks any unmarked traffic entering the LAN with DSCP AF21.
The service policy is applied outbound on the WAN interface with service-policy output WAN-EDGE. Outbound is the critical direction because that is where the router’s transmit buffers can fill up.
Verification starts with show policy-map interface GigabitEthernet0/0/0, which displays per-class packet counts, bytes, and, crucially, any drops or tail-drops. The engineer notices zero priority-queue drops and confirms that voice and video are using the expected bandwidth. They also deploy an IP SLA operation that sends UDP jitter probes to the cloud PBX server every 30 seconds and graphs the results in a network monitoring tool. If round-trip delay exceeds 150 ms for three consecutive probes, an SNMP trap alerts the team. Every month, the engineer exports NetFlow data to a collector, generating a report that shows top talkers and protocol distribution, which helps justify the QoS policy to management.
The 350-401 ENCOR exam targets objective 6.2 directly: you must be able to configure and verify QoS classification, marking, and queuing, plus basic performance monitoring. Questions are a mixture of multiple choice, drag-and-drop, and sometimes simulation-style items where you need to interpret show command output.
Concept areas that appear again and again include:
Differentiated Services: DSCP values, especially EF (46), AFxy, and their decimal-to-binary conversions. Be ready to identify the per-hop behaviours and their intended use.
Trust boundaries: where should you trust an incoming marking? Generally, mark as close to the source as possible and never trust user-facing access ports. They will ask whether a switch should trust CoS on an access port (no) or on a trunk port from a phone (maybe).
MQC syntax: the correct order of class-map, policy-map, service-policy. The difference between match statements inside a class map (match-any vs match-all). They love to show a snippet where the policy is attached inbound but the candidate expects queuing (queuing only works outbound).
Queuing algorithms: which one provides low-latency service with a strict priority queue? LLQ. What command reserves bandwidth? bandwidth inside a class in a policy map. What command creates the priority queue? priority. A common trap is confusing the bandwidth and priority commands; priority alone would not guarantee bandwidth to other classes, so you must also use bandwidth for them.
Policing vs Shaping: Policing drops excess, shaping delays it. Policing is used for rate-limiting incoming traffic, shaping for smoothing outbound. A typical question: “Which method buffers excess packets?” Answer: shaping.
Performance monitoring tools: match a tool to its function. NetFlow gives flow-level detail (who talked to whom, how much, which ports), IP SLA performs active synthetic tests (jitter, latency), SNMP retrieves device statistics like interface counters and CPU usage.
Trap patterns the exam writers exploit:
Showing a show policy-map interface output with drops in the priority queue, asking what to do. The correct answer is often increase the priority bandwidth or shape the traffic before it enters the priority queue, not simply add more bandwidth to the link.
Providing a configuration where a policy map is applied to an interface but only a class-default exists; the candidate must realise no effective prioritisation is happening.
Asking for a verification command: show policy-map interface is the main one; show class-map only shows class definitions, not runtime statistics.
Using ECN (Explicit Congestion Notification) or WRED (Weighted Random Early Detection) in conjunction with queuing – know that WRED randomly drops packets before the queue fills to avoid tail-drop.
Key definitions to memorise:
DSCP: 6-bit field, values 0-63.
EF: 101110 binary, decimal 46.
CoS: 3-bit field in 802.1Q tag, values 0-7.
MQC components: class-map (classification), policy-map (action), service-policy (attachment).
LLQ: priority queue with policing to prevent starvation.
IP SLA: active probe generating synthetic traffic.
QoS organises congestion by classifying and prioritising traffic; it does not increase physical bandwidth.
The Modular QoS CLI (MQC) uses class maps to identify traffic, policy maps to define actions, and service policies to attach those actions to an interface.
DSCP is a 6-bit field in the IP header that supports 64 priority values, with EF (46) reserved for real-time voice and AFxy for assured forwarding.
Low Latency Queuing (LLQ) provides a strict priority queue policed to a maximum rate, making it the standard choice for voice traffic on Cisco devices.
Trust boundaries determine where QoS markings are accepted; you should mark as close to the source as possible and never trust an end-user access port.
Performance monitoring tools complement QoS: NetFlow analyses traffic patterns, IP SLA measures latency and jitter, and SNMP collects device health metrics.
These come up on the exam all the time. Here's how to tell them apart.
DSCP
Uses 6 bits, providing 64 distinct code points
Defines per-hop behaviours (EF, AF, CS) that map to specific forwarding treatments
Backward-compatible: the first 3 bits overlap with IP Precedence
IP Precedence
Uses only 3 bits, giving 7 usable priority levels (0-7)
Does not define standard behaviours; purely a numeric priority
Legacy field; modern QoS configurations rely on DSCP instead
LLQ (Low Latency Queuing)
Includes a strict priority queue that is serviced immediately
Traffic in the priority queue is policed to a maximum rate to prevent starvation
Designed for real-time, delay-sensitive traffic like voice
CBWFQ (Class-Based WFQ)
All classes share bandwidth proportionally; no strict priority queue
Each class gets a minimum bandwidth guarantee but no immediate preemption
Ideal for data applications that need predictable bandwidth but can tolerate some delay
Policing
Excess traffic is dropped or re-marked immediately, introducing no extra delay
Operates at line rate; useful for rate-limiting inbound traffic from a customer
Can cause TCP global synchronisation due to tail-drop
Shaping
Excess traffic is buffered and sent at a smoothed rate, which adds latency
Used on egress to conform to a contracted rate without dropping packets
Works well with TCP because it avoids sudden losses, at the cost of queuing delay
NetFlow
Exports detailed flow records (source, destination, protocol, bytes, packets)
Used for traffic analysis, billing, and security forensics
Can be sampled or full-fidelity; typically pushed from the router to a collector
SNMP
Polls device counters such as interface octets, CPU, and queue drops
Used for real-time capacity monitoring and fault management
Operates on a poll/response model using OIDs; less detail per traffic flow
Mistake
QoS increases the total bandwidth of a network link.
Correct
QoS does not add bandwidth; it manages how existing bandwidth is allocated among different traffic types when the link is congested.
The word ‘quality’ makes learners think the connection becomes faster, much like getting a higher-speed plan from an ISP; in reality, QoS only reorganises the queue.
Mistake
You can classify traffic only by looking at IP addresses or TCP/UDP port numbers.
Correct
Classification can use a wide range of attributes, including MAC addresses, protocol types, application signatures through NBAR, and even packet size or HTTP URLs.
Introductory material often shows simple ACL-based classification, and many never realise that deep packet inspection is a powerful alternative.
Mistake
Setting a high DSCP value like EF guarantees end-to-end priority across the internet.
Correct
DSCP markings are only trusted inside your own administrative domain; internet service providers typically ignore or re-mark these values to best-effort.
The assumption that the internet honours your markings is common because we think of IP as a single network, but QoS policies are local.
Mistake
The strict priority queue in LLQ can starve all other traffic because it always empties first.
Correct
LLQ includes a built-in policer; traffic exceeding the configured priority bandwidth is dropped, ensuring bandwidth remains for other queues.
The term ‘strict priority’ suggests unlimited preemption, but Cisco routers enforce a hard limit on that queue to protect other classes.
Mistake
Queuing and policing are just two names for the same congestion control technique.
Correct
Queuing organises how packets wait and are serviced during congestion; policing enforces a rate limit by dropping or re-marking excess traffic immediately.
Both deal with congestion, so beginners conflate them; the key difference is that queuing adds delay while policing does not.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
DSCP is a 6-bit field in the IP header (values 0-63) that replaces the older 3-bit IP Precedence field (values 0-7). DSCP offers much finer granularity and standardised per-hop behaviours like EF and AFxy, while IP Precedence only allowed numerical priority levels.
Routers can use NBAR (Network Based Application Recognition) to inspect the packet payload and recognise applications such as Skype, SIP, or RTP. Alternatively, you can match on UDP port ranges typically used by voice codecs, like 16384-32767.
No. QoS only organises how your limited bandwidth is shared. If the link itself is undersized for the total traffic, QoS will ensure voice is protected, but web pages and file transfers will still be slow; you need more bandwidth.
The `priority` command creates a strict-priority queue with a built-in policer – ideal for delay-sensitive voice – while `bandwidth` gives a class a minimum bandwidth guarantee from the remaining pool but does not provide strict priority. You use `priority` for voice and `bandwidth` for video or business data.
Shaping buffers excess traffic and releases it at a steady rate, avoiding abrupt drops. This is useful when an upstream provider enforces a strict rate limit; by shaping, you prevent TCP retransmissions that would occur if you policed and dropped packets aggressively.
Use `show policy-map interface [interface-name]` to see real-time queue statistics, including the number of packets queued and dropped per class. Complement this with IP SLA probes or NetFlow exports to verify end-to-end quality.
You've finished QoS and Network Performance Management. Continue through the 350-401 ENCOR study guide to build a complete picture of the exam.
Done with this chapter?