# DSCP

> Source: Courseiva IT Certification Glossary — https://courseiva.com//glossary/dscp

## Quick definition

DSCP is like a priority sticker placed on data packets traveling across a network. Routers and switches read this sticker to decide which packets should be handled faster, especially during congestion. It helps ensure that important traffic, like video calls or VoIP, gets through smoothly while less critical data, like file downloads, can wait. DSCP is a core part of how modern networks manage Quality of Service (QoS).

## Simple meaning

Imagine you are sending packages through a postal system. Some packages are urgent, like a birthday gift that must arrive tomorrow, while others are just regular mail, like a monthly magazine. If the postal truck gets full, the driver needs to decide which packages to deliver first. DSCP works like a sticker that tells the driver the urgency level. In computer networking, data is broken into packets. Each packet has a header, like an envelope, that contains routing information. Inside that header is a small field, only 6 bits long, called the DSCP field. This field can hold a number from 0 to 63, and each number corresponds to a particular class of service. For example, a voice call packet might have a DSCP value of 46, which is EF (Expedited Forwarding), meaning it needs low delay and low jitter. A bulk file transfer might have a DSCP value of 0, which is best-effort, meaning it can wait if there is congestion.

The beauty of DSCP is that it is standardized across different vendors and devices. A Cisco router, a Juniper switch, and a Linux server all understand the same DSCP markings. This allows network administrators to define policies once and apply them across the entire network. When a router sees a packet with a high-priority DSCP value, it will place that packet into a faster queue, give it more bandwidth, and forward it before lower-priority packets. This is the foundation of Differentiated Services (DiffServ), which is the dominant QoS model used in IP networks today.

To make it even simpler, think of DSCP as a lane system on a highway. Regular traffic uses the normal lanes. But emergency vehicles have their own lane, and they can bypass traffic jams. DSCP values assign packets to different virtual lanes. Network devices then treat each lane according to the policy you set. This is much more efficient than treating all packets equally, because not all data has the same needs. Real-time communication, like a Zoom meeting or a VoIP call, cannot tolerate delays. DSCP ensures that those packets get priority so that your call does not break up. Meanwhile, a background software update can take its time without affecting your meeting quality.

## Technical definition

DSCP stands for Differentiated Services Code Point. It is a 6-bit field located in the DS field of an IP packet header, replacing the older Type of Service (ToS) byte. The DS field is defined in RFC 2474. DSCP is the core mechanism for implementing Differentiated Services (DiffServ) QoS architecture. The 6 bits allow for up to 64 different code points (0-63). These code points are grouped into three main categories: Default (Best Effort, DSCP 0), Class Selector (CS) values that maintain backward compatibility with IP precedence, and Assured Forwarding (AF) and Expedited Forwarding (EF) code points.

Expedited Forwarding (EF) is standardized as DSCP 46. It is designed for low-loss, low-latency, low-jitter traffic such as VoIP. EF traffic is typically policed to a specific rate and given strict priority queuing. Assured Forwarding (AF) is defined in RFC 2597. AF has four classes (AF1 through AF4) and three drop probabilities within each class (low, medium, high). For example, AF11 (DSCP 10) is class 1, low drop probability, while AF13 (DSCP 14) is class 1, high drop probability. This structure allows for differentiated treatment even within the same traffic class. When congestion occurs, packets with higher drop probability are discarded first.

In practice, network devices use DSCP values to classify packets upon ingress. A router or switch marks or remarks the DSCP value based on policy. Then, throughout the network, each hop uses the DSCP value to apply Per-Hop Behaviors (PHBs). PHBs define how a particular device treats packets: which queue they go into, how much bandwidth they get, whether they are dropped early (using WRED), and so on. The entire path must be configured consistently, or a high-priority packet could be treated as best-effort downstream if a device does not honor the marking.

DSCP is commonly used in enterprise networks, service provider networks, and data centers. It is also used in MPLS networks, where the MPLS EXP field is often derived from the IP DSCP. Voice and video traffic usually receive EF or AF41 (DSCP 34) markings. Network control traffic like OSPF, BGP, or SSH might use CS6 (DSCP 48) or CS7. For exam purposes, it is critical to know the standard DSCP values and their corresponding PHBs. Memorizing EF (46), AF31 (26), AF41 (34), and default (0) is a good start. Also note that DSCP values can be expressed in decimal, binary, or hexadecimal, and conversion between these is often tested.

## Real-life example

Imagine you are at an airport security checkpoint. There are several lanes. Most passengers join the regular line and wait their turn. But there is also a priority lane for first-class passengers and travelers with disabilities. Additionally, there is a special express lane for flight crew members who need to get to the gate quickly. The airport staff directs each passenger to the appropriate lane based on their ticket or uniform. In this analogy, each passenger is a data packet, and the security checkpoint is a router. DSCP is like the ticket type or uniform that tells the staff which lane to use.

Now, suppose you are a first-class passenger with a tight connection. Your ticket has a special marking that the gate agent sees. They let you cut ahead in the priority lane. This is exactly how DSCP works for VoIP traffic. A voice packet carries a marking that says 'I am time-sensitive.' The router sees that marking and places the packet in the priority queue, so it gets processed before a regular email packet that is just a passenger with a coach ticket.

But there is more nuance. In the airport, not all priority passengers are equal. Some may have a higher status. Similarly, DSCP has different levels. For example, AF41 (DSCP 34) might be like a business-class ticket, while EF (DSCP 46) is like the crew member running to the gate. The router, like the airport staff, has been trained to recognize these differences and apply the correct treatment. This ensures that the most critical traffic, such as a CEO's video conference or a 911 call center's VoIP, gets the best possible service. If all traffic were treated equally, like having only one line at security, the urgent packets would get stuck behind bulk file transfers, causing delays and poor quality.

## Why it matters

DSCP matters because the internet and modern enterprise networks carry a mix of traffic with very different requirements. Without DSCP, all packets are treated equally. This is a problem because real-time applications like VoIP, video conferencing, and online gaming require low latency and low jitter. A file download or email can tolerate delays, but a voice call cannot. If a bulk download of a 100 MB file arrives at a router at the same time as a voice packet, and the router has no QoS policy, the voice packet may have to wait in line, causing a noticeable delay or drop in call quality. DSCP solves this by allowing the network to differentiate traffic and give preferential treatment to time-sensitive packets.

For IT professionals, implementing DSCP correctly is a fundamental skill. When you configure QoS on Cisco routers or switches, you typically set trust boundaries on ingress interfaces. For example, you may trust DSCP markings from IP phones but remark all other traffic to a default value. You then configure class maps that match DSCP values, policy maps that define actions like priority queuing or bandwidth reservation, and service policies that attach those actions to interfaces. A common mistake is not marking traffic at the source or not trusting markings at the edge, which renders the entire QoS design useless.

DSCP is also critical for service level agreements (SLAs). If a company buys an MPLS circuit with a guaranteed bandwidth for VoIP, the provider will enforce that SLA based on DSCP markings. If the customer sends voice traffic with standard best-effort markings, the provider will treat it as regular data, and the SLA will not be met. Therefore, understanding DSCP is not just a theoretical concept; it directly impacts network performance, user experience, and compliance with contracts. In the CCNA exam, QoS topics including DSCP can appear in multiple-choice questions, configuration simulations, and troubleshooting scenarios. Understanding DSCP is essential for passing the exam and for real-world network administration.

## Why it matters in exams

In the CCNA exam, QoS is a core topic, and DSCP is one of the foundational elements. The exam objectives under Network Fundamentals include 'Describe the purpose of QoS' and 'Identify the basic QoS mechanisms.' Within that, understanding DSCP and how it relates to classification and marking is essential. The exam expects you to know the difference between Layer 2 QoS (CoS) and Layer 3 QoS (DSCP). You should be able to identify standard DSCP values such as EF, AF41, and default. You may be asked which DSCP value is used for VoIP (EF, 46), or which is used for video (often AF41, 34).

Questions can be straightforward, like 'Which DSCP value corresponds to Expedited Forwarding?' or more scenario-based, like 'A network administrator wants to prioritize VoIP traffic. Which DSCP marking should be applied to the packets?' You may also see questions that require you to decode a DSCP value from a hex or binary representation. For example, the DS field may be shown as 0xB8, and you need to extract the DSCP value (0xB8 in binary is 10111000, the first 6 bits are 101110 which is decimal 46, EF).

Configuration simulations may require you to use the 'match ip dscp' command in a class map, or to set a trust boundary with 'mls qos trust dscp'. You might also be asked to troubleshoot why QoS is not working, where the answer involves checking if DSCP markings are being trusted on the ingress interface. Additionally, the exam tests your understanding of the relationship between IP precedence and DSCP. Since IP precedence used the first 3 bits of the ToS byte, DSCP is backward compatible. For example, IP precedence 5 (101) corresponds to DSCP 40 (101000) in the class selector category. This relationship is frequently tested.

Another important exam topic is the difference between marking and classification. Classification identifies traffic (e.g., by ACL or NBAR), while marking sets the DSCP value. The exam may ask which tools are used for each. Finally, be aware that DSCP is also relevant to Wireless QoS (WMM) and SD-WAN policies. In the CCNA, you will encounter DSCP primarily in the context of QoS configuration on Cisco switches and routers. Understanding DSCP values and their usage is not optional; it is a direct exam objective.

## How it appears in exam questions

DSCP appears in CCNA questions in several distinct forms. The first and most common is the direct knowledge question. For example: 'Which DSCP value is used for Expedited Forwarding?' (Answer: 46). Or 'Which of the following is the DSCP value for AF31?' (Answer: 26). These questions test your memorization of the standard code points. Expect to see decimal values and perhaps binary or hex representations. For example, the DS field might be shown as a byte, and you must extract the DSCP value.

The second type is scenario-based. A question will describe a network situation where a certain type of traffic is performing poorly. You need to propose a QoS solution, and that will involve selecting the correct DSCP marking. For instance: 'An organization uses VoIP and video conferencing. During peak hours, voice calls experience jitter. Which DSCP marking should be applied to video traffic to ensure it does not interfere with voice?' The answer would be AF41 (or AF31) rather than EF, because EF is reserved for voice and should not be shared.

The third type is configuration and troubleshooting. You might be given a running configuration snippet and asked to identify an error. For example, a class map might match the wrong DSCP value. Or a trust command might be missing on an access port connected to an IP phone. A typical troubleshooting question: 'A network administrator has configured QoS to prioritize VoIP traffic, but VoIP is still experiencing delays. What is the most likely cause?' Options like 'DSCP markings are not being trusted on the switchport,' or 'The DSCP value on the IP phone is set to 0' are common. You need to know that the correct trust command is 'mls qos trust dscp' for Cisco switches.

Finally, there are design questions. A question might ask about the number of classes available with DSCP (64, but only a subset is standardized). Or you might be asked to compare DSCP to 802.1p CoS (which has only 8 values). Understanding these differences helps you choose the right technology for a given requirement. The exam will also test your ability to convert between IP precedence and DSCP. For example, 'If a packet has IP precedence set to 5, what is the corresponding DSCP class selector value?' (Answer: 40). To sum up, your preparation should include memorizing key DSCP values, understanding the DiffServ architecture, and being able to apply that knowledge in configuration and troubleshooting scenarios.

## Example scenario

You are a network technician at a mid-sized company. The company has a call center with 100 agents using IP phones. Additionally, the sales team uses video conferencing with clients. Users are complaining that voice calls drop and video freezes during peak hours (10 AM to 12 PM). Your manager asks you to configure QoS. You decide to use DSCP markings to prioritize traffic.

You first identify the traffic types. Voice traffic from the IP phones should be marked as EF (DSCP 46) because it requires the lowest latency and jitter. Video conferencing traffic should be marked as AF41 (DSCP 34) because it also needs priority, but can tolerate a bit more delay than voice. You configure the IP phones to mark their own traffic with EF, using the 'auto qos voip trust' feature on the Cisco switch. For video traffic, you use an ACL to match the video application's ports, then create a class map that matches that traffic, and a policy map that sets the DSCP to 34 and puts it in a priority queue with a policed rate.

After applying the service policy to the WAN interface, you test by running a large file transfer while on a voice call. The voice call is now clear. The video conference also works without freezing. However, you realize that the file transfer slowed down significantly. That is expected because the file transfer uses best-effort (DSCP 0). The QoS policy ensures that voice and video get bandwidth and priority, while the file transfer is deprioritized. Users notice the improvement. This scenario demonstrates the real-world application of DSCP for solving performance issues in a converged network. The CCNA exam expects you to understand this process and be able to configure it correctly.

## Common mistakes

- **Mistake:** Confusing DSCP with IP Precedence and using them interchangeably
  - Why it is wrong: IP Precedence uses only 3 bits (values 0-7) while DSCP uses 6 bits (values 0-63). They are not the same. Some DSCP values are backward compatible (like CS values), but most are different. Using IP Precedence marking instead of DSCP wastes the capability of modern QoS.
  - Fix: Always use DSCP when possible. If you see a configuration with 'ip precedence' commands, know that it is legacy. For new designs, use 'set dscp' in policy maps.
- **Mistake:** Marking all traffic with EF (DSCP 46) thinking it gives the best performance to everything
  - Why it is wrong: EF is designed for traffic with strict real-time requirements, like VoIP. If you mark all traffic as EF, the priority queue can become congested, causing drops and defeating the purpose of QoS. Non-real-time traffic like email or web browsing does not benefit from EF and can harm voice quality.
  - Fix: Reserve EF only for traffic that truly needs low latency and low jitter (e.g., VoIP). Use AF classes for applications that need some priority but are more tolerant (e.g., video, mission-critical data). Use default (0) for everything else.
- **Mistake:** Forgetting to trust DSCP markings on the interface where traffic enters the network
  - Why it is wrong: If a switch or router does not trust the DSCP marking, it may re-mark the packet to 0 (default) or to a default CoS value. This renders any marking done by the source device useless, and QoS policies downstream will not see the intended priority.
  - Fix: On access ports connecting to trustable devices like IP phones or video endpoints, use the command 'mls qos trust dscp' (Cisco). For untrusted devices, classify traffic at the switch level using ACLs instead of trusting markings.
- **Mistake:** Assuming DSCP markings survive across different network domains or service providers
  - Why it is wrong: When traffic leaves your network and enters a service provider's network, the provider may re-mark or ignore your DSCP values. For example, an ISP may only honor their own markings. This means your end-to-end QoS may not work without a contract that includes remarking rules.
  - Fix: Verify with your service provider if they honor DSCP markings. Often, you need to negotiate a DSCP re-marking policy in the SLA. Alternatively, use MPLS EXP bits instead of IP DSCP in MPLS environments.

## Exam trap

{"trap":"A question shows the DS field byte as 0xB8 and asks for the DSCP value. Many learners incorrectly convert the entire byte (184 in decimal) and think the DSCP is 184.","why_learners_choose_it":"They forget that DSCP is only the first 6 bits of the 8-bit DS field. The last 2 bits are reserved (ECN). So they convert the whole hex byte to decimal, which gives 184, but the DSCP is actually 46 (the first 6 bits).","how_to_avoid_it":"Always remember: the DSCP field is the first 6 bits. For hex conversion, write the byte in binary, take the first 6 bits (leftmost), convert that binary number to decimal. 0xB8 = 10111000. First 6 bits = 101110 = decimal 46 (EF). Practice a few conversions."}

## Commonly confused with

- **DSCP vs 802.1p (CoS):** 802.1p is a Layer 2 QoS marking in the Ethernet frame header, using 3 bits (8 values) for class of service. DSCP is a Layer 3 marking in the IP header, using 6 bits (64 values). CoS is used inside a LAN (switch-to-switch), while DSCP is used across routed networks. They can be mapped to each other, but they are not the same. (Example: An IP phone marks a VoIP packet with CoS 5 on the LAN switch port. When the packet leaves the router to the WAN, the router maps CoS 5 to DSCP EF (46) so the ISP can prioritize it.)
- **DSCP vs IP Precedence:** IP Precedence is the older, 3-bit QoS field that preceded DSCP. DSCP is backward compatible with IP Precedence through the Class Selector (CS) values (e.g., IP Precedence 5 = CS5 = DSCP 40). However, DSCP offers much finer granularity (64 vs 8 values) and includes defined PHBs like EF and AF. Never use IP Precedence in new designs. (Example: A legacy network uses IP Precedence 5 for voice. To integrate with a modern DSCP network, you can map IP Precedence 5 to DSCP 40 (CS5). But it is better to use DSCP 46 (EF) for voice.)
- **DSCP vs MPLS EXP:** MPLS EXP is a 3-bit field in the MPLS shim header used for QoS within an MPLS network. It serves a similar purpose to DSCP but at a different protocol layer. Often, the MPLS EXP field is set by copying the IP DSCP value at the ingress LER. Inside the MPLS core, routers look at EXP, not DSCP. (Example: A packet with DSCP 46 (EF) enters an MPLS network. The ingress router copies the DSCP to the EXP field (e.g., EXP 5). MPLS core routers now use EXP 5 for priority queuing, ignoring the original DSCP.)

## Step-by-step breakdown

1. **Packet Arrives at Ingress Interface** — A router or switch receives an IP packet on an ingress interface. The network device reads the DS field in the IP header to extract the DSCP value (6 bits). This value indicates the packet's priority class.
2. **Classification (Optional but Common)** — If the interface is configured to trust DSCP markings from the source, the packet is classified based on its existing DSCP value. If the interface is untrusted, the device may classify the packet using other criteria (e.g., ACL, NBAR) and then assign a DSCP value based on policy.
3. **Policing or Marking** — Based on the configured policy map, the device may police the traffic (enforce a rate limit) or re-mark the DSCP value. For example, if traffic exceeds a certain rate, the DSCP may be changed to a lower priority (e.g., from EF to AF41) to signal downstream devices that this packet is now less important.
4. **Queuing and Scheduling** — The packet is placed into a queue. DSCP determines which queue: typically, EF goes into the priority queue (strict priority), AF classes go into weighted fair queues, and best-effort goes into the default queue. The scheduler then decides when to transmit packets based on queue priority and configured bandwidth weights.
5. **Congestion Management (WRED)** — If the queue starts to fill up, Weighted Random Early Detection (WRED) may selectively drop packets based on their DSCP value. Packets with higher drop probability (e.g., AF13) are dropped before packets with lower drop probability (e.g., AF11). This helps avoid global synchronization and ensures higher-priority traffic is retained.
6. **Packet Transmitted on Egress Interface** — The packet is transmitted out the egress interface. The DSCP value remains unchanged (unless explicitly re-marked). Downstream routers will read the same DSCP value and apply their own PHBs, ensuring consistent treatment across the network.

## Practical mini-lesson

In a real network, QoS configuration using DSCP is a multi-step process that requires planning. Start by identifying the types of traffic in your network and their requirements. Voice traffic, for example, is very sensitive to delay and jitter. It should be marked with EF (DSCP 46) and placed in the priority queue. Video conferencing is also sensitive but can tolerate slight delays, so it gets AF41 (DSCP 34) or AF31 (DSCP 26). Mission-critical data, like database replication, might use AF21 (DSCP 18). All other traffic (web, email, file transfers) gets best-effort (DSCP 0).

Once you have defined your classes, you need to mark the traffic. The ideal place to mark is at the source. For example, IP phones from Cisco and other vendors mark voice packets with EF at the phone itself. You trust that marking on the switch port. For other devices, you can configure access control lists (ACLs) to match specific applications or port ranges, then set the DSCP value in a policy map. For example, to mark video traffic from a video server, you could create an ACL that matches TCP/UDP ports 3478-3481 (common for video conferencing), then create a class map that matches that ACL, and a policy map that sets dscp 34.

After marking, you apply the policy to the interface. On Cisco switches, this involves enabling QoS globally with 'mls qos', setting trust on access ports (e.g., 'mls qos trust dscp' for IP phone ports), and attaching service policies to interfaces or VLANs. On routers, you configure class maps, policy maps, and apply them to interfaces with the 'service-policy' command.

Troubleshooting QoS requires checking statistics. Use 'show policy-map interface' to see how many packets matched each class, how many were dropped, and how many bytes were queued. If you see drops in the priority queue, the policer may be too low. If you see no packets matching a class, the marking might not be happening, or the trust command might be missing. Verify DSCP values with packet captures or 'show mls qos interface statistics'. A common issue is that a switchport connected to a PC is set to trust dscp, but the PC marks everything with 0, so no priority is given. The fix is to classify traffic on the switch itself rather than trusting the PC.

DSCP is also important in SD-WAN and cloud environments. For example, in Cisco SD-WAN, you use DSCP for forwarding classes within the fabric. In AWS, you can use DSCP values in traffic mirroring and VPC flow logs. Understanding DSCP is therefore a skill that extends beyond CCNA into higher-level certifications like CCNP Enterprise and DevNet.

## Memory tip

Think 'EF = Emergency First' for DSCP 46, the highest priority. For AF classes, remember the digits: Class (1-4) and Drop probability (1=low, 2=mid, 3=high). So AF41 is high class, low drop.

## FAQ

**What is the difference between DSCP and IP Precedence?**

DSCP uses 6 bits (64 values) while IP Precedence uses only 3 bits (8 values). DSCP is the modern standard defined in RFC 2474. IP Precedence is legacy. DSCP includes IP Precedence through Class Selector (CS) values for backward compatibility.

**How do I choose between EF and AF for marking traffic?**

Use EF (DSCP 46) only for traffic that requires extremely low delay, jitter, and loss, such as VoIP. Use AF classes (e.g., AF41 for video, AF21 for critical data) for traffic that needs priority but can tolerate some delay. EF should be used sparingly because it uses strict priority queuing.

**What does 'trust DSCP' mean?**

It is a command on a switch or router interface that tells the device to accept the DSCP marking already present on incoming packets instead of ignoring it. This is typically used on ports connected to IP phones or other trusted devices that set their own DSCP values.

**Can I use DSCP across the internet?**

Generally, DSCP markings are not honored across the public internet. ISPs often overwrite or ignore them. DSCP is meant for use within a single administrative domain (your own network) or in a controlled WAN environment with a service provider agreement.

**What is the DSCP value for best-effort traffic?**

Best-effort traffic is marked with DSCP 0 (also called Default Forwarding). This is the default value for any packet that does not have a QoS marking applied.

**How do I convert a DSCP value from decimal to hex?**

DSCP values are 6 bits. Take the decimal value, convert to 6-bit binary, then pad to get 8 bits (add two zeros at the end for the ECN bits), then convert that byte to hex. For example, DSCP 46 binary is 101110, padded = 10111000, hex = 0xB8.

## Summary

DSCP (Differentiated Services Code Point) is a 6-bit field in the IP header that forms the basis of the DiffServ QoS model. It allows network devices to classify and prioritize traffic into 64 different classes, enabling granular quality of service. In practice, DSCP is used to give preferential treatment to real-time applications like VoIP and video conferencing, ensuring low latency, low jitter, and low packet loss. For the CCNA exam, you need to understand key DSCP values (EF=46, AF41=34, default=0), how to configure trust boundaries, and how to apply marking policies. Common mistakes include confusing DSCP with IP Precedence, marking all traffic with EF, and failing to trust markings on ingress interfaces. Mastering DSCP is essential for both the exam and for real-world network performance management. By learning to implement QoS with DSCP, you gain the ability to design networks that deliver consistent quality even under heavy load, a skill highly valued in the IT industry.

---

Practice questions and the full interactive page: https://courseiva.com//glossary/dscp