QoS per-hop behavior
Classification, marking, queuing, congestion management and policing versus shaping — the per-hop forwarding behaviors QoS defines.
Classification through policing
QoS defines per-hop behavior: what each device does to a packet as it forwards it, hop by hop — that's the DiffServ model — per-hop, with no built-in end-to-end reservation (reservation-oriented approaches like IntServ/RSVP are a different model). The chain is: classify (recognize traffic) → mark (tag it for downstream trust) → queue/schedule (who goes first under congestion) → optionally police/shape (enforce rates).
QoS mechanisms
| Mechanism | What it does | Where it acts |
|---|---|---|
| Classification | Identify traffic by ACL, port, DSCP, NBAR | Ingress |
| Marking | Write DSCP (L3) or CoS (802.1p, L2 tag) into the packet | Ingress — closest to the source |
| Trust boundary | Where you accept vs rewrite arriving marks | Network edge/access ports |
| Congestion management (queuing) | Order packets for transmission — e.g., priority queue for voice | Egress, when the link is full |
| Congestion avoidance | Drop early to prevent tail-drop meltdown (WRED) | Egress before buffers fill |
| Policing | Enforce a rate — excess is dropped or re-marked | Ingress or egress |
| Shaping | Enforce a rate — excess is buffered/smoothed | Egress — delays rather than drops |
Marking and trust
Marking values to recognize
| Field | Where | Examples |
|---|---|---|
| DSCP | IPv4/IPv6 header (6 bits) | EF (voice), AF41/AF31 classes, CS0/BE default |
| CoS (PCP) | 802.1Q tag (3 bits) | 0–7; 5 conventionally voice |
DSCP travels end-to-end in the IP header; CoS exists only inside an 802.1Q tag — on interswitch trunks and on tagged voice/edge frames alike.
- Link
- 100 Mb WAN uplink saturating during backups
- Without QoS, voice packets queue behind backup bulk — jitter and loss follow buffer depth.
- Mark voice EF at the access edge (trust boundary), police bulk data to a ceiling.
- Priority-queue EF at egress → voice goes first under congestion; bulk fills the remainder.
Per-hop QoS is applied at every congested device — classification and marking happen once at the edge, queuing happens everywhere the link can saturate.
Policing versus shaping
Policing measures traffic against a configured rate and drops or re-marks the excess — it does not delay. Shaping buffers excess traffic to emit a smooth rate — it delays instead of dropping but can still drop once buffers fill. Voice is delay-, jitter- and loss-sensitive, so the usual pattern is a parent WAN shaper with a child priority queue rather than shaping alone; providers police customers, enterprises shape to their contracted rate.
Verifying QoS
show policy-map interfaceshows packets matched per class and drops — proof traffic is being classified and queued.- Marked values can be read with packet captures — verify the edge actually writes DSCP.
- If queues never fill, QoS has nothing to do — benefits appear only under congestion.
Common mistakes
- Expecting QoS to create bandwidth — it only chooses who suffers when the link is full.
- Marking deep in the network — mark at the trust boundary (edge); re-marking at every hop defeats the purpose.
- Confusing policing (drop/re-mark) with shaping (buffer/smooth).
- Treating CoS as end-to-end or trunk-only — it lives inside any 802.1Q tag, including tagged frames on voice/edge trunks.
- Queuing voice with everything else — EF traffic needs a priority queue, not just a higher weight.
Observation: Priority policy applied, but calls degrade during peaks.
- Voice traffic not classified into the priority class
- Policy applied on the wrong interface/direction
- Upstream devices strip or ignore the markings
| Check | Indicates |
|---|---|
show policy-map interface class counters | Zero matches in the voice class → classification is wrong, not the queue. |
| Direction of service-policy application | Queuing is egress — applied inbound it does nothing. |
| DSCP values arriving at the WAN edge | Upstream re-marking erases your classes. |
Correction: Fix classification/direction/marking as the evidence indicates.
Class counters show voice matching and priority drops stay near zero under load.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 2474 — Definition of the Differentiated Services Field (DS Field) — reviewed 2026-11-02
- RFC 4594 — Configuration Guidelines for DiffServ Service Classes — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.