DiffServ Explained: DSCP Marking and Per-Hop Behaviour for Network+

DiffServ — Differentiated Services — is how quality of service is actually implemented on modern networks. Traffic is marked at the edge, and each device along the path treats it according to that marking.

DiffServ versus IntServ

The comparison that explains why DiffServ won.

IntServ — Integrated Services — reserves resources end to end for each individual flow using RSVP. Every router on the path holds state for every flow. It gives genuine guarantees and it does not scale: a core router carrying millions of flows cannot track them all.

DiffServ classifies traffic into a small number of classes, marks each packet, and lets every device apply a per-class behaviour. Routers hold no per-flow state — they read the marking and act.

The trade-off is guarantees versus scalability. IntServ promises a specific flow specific resources; DiffServ promises a class relative treatment. DiffServ scales, so DiffServ is what you meet.

DSCP and the header

The original IPv4 header had a Type of Service byte with a 3-bit IP Precedence field. DiffServ redefined that byte: the first six bits are the DSCP — Differentiated Services Code Point — giving 64 possible values, with the remaining two bits used for Explicit Congestion Notification.

The exam point to hold: DSCP is 6 bits at layer 3 in the IP header, while CoS is 3 bits at layer 2 in the 802.1Q VLAN tag. Because CoS lives in the VLAN tag, it is lost the moment a frame leaves a trunk — which is precisely why DSCP is needed for markings that must survive across a routed network.

Per-hop behaviours

A DSCP value does not describe the traffic; it requests a per-hop behaviour from each device. The standard behaviours are worth recognising.

Default (DF), DSCP 0 — best effort, no special treatment.

Expedited Forwarding (EF), DSCP 46 — low latency, low jitter, low loss, with a strict bandwidth ceiling. This is the voice class, and EF = 46 is the single most examined DSCP value.

Assured Forwarding (AF) — twelve values in four classes, each with three drop precedences, written AFxy where x is the class (1 to 4) and y the drop precedence (1 to 3). AF41 is the common video marking. Higher drop precedence means discarded sooner under congestion.

Class Selector (CS), CS0 to CS7 — backward compatible with the old IP Precedence values. CS6 and CS7 are reserved for network control traffic such as routing protocols.

Common markings in practice: voice EF (46), video AF41 (34), call signalling CS3 (24), transactional data AF21 (18), routing CS6 (48), best effort 0, and scavenger CS1 (8) for traffic that should yield to everything else.

The trust boundary

The most important operational concept, and one exams ask about.

Any host can set any DSCP value in the packets it sends. Nothing prevents a workstation marking its bulk file transfer as EF and claiming the voice priority queue.

So networks establish a trust boundary: the point at which markings are believed. Inside it markings are trusted and acted upon; at or outside it, incoming markings are remarked or cleared.

Typically the boundary is the access switch. Markings from an IP phone may be trusted, because the switch can identify the phone; markings from a PC behind that phone are not, and are reset to zero. If a scenario describes users getting priority they should not have, the trust boundary is the answer.

Classification, marking and the rest

The full chain: classify traffic by port, protocol, source or deep inspection; mark it once, as close to the source as possible so downstream devices do not reclassify; queue it according to the per-hop behaviour; police or shape to keep each class within its allocation; and apply congestion avoidance, dropping selectively before queues fill.

Marking once at the edge is the efficiency argument for DiffServ — the expensive classification decision happens at a low-speed access port, and every core device only reads six bits.

Where it breaks down

Two practical limits. DSCP markings are not preserved across the internet — service providers routinely remark or clear them at their edge, so end-to-end QoS across the public internet is not achievable. Markings survive within a network or across a provider service where it is contractually agreed, such as MPLS.

And DiffServ manages contention; it does not create bandwidth. On a link that is not congested, QoS does nothing at all, because there is no queue to prioritise.

What to remember

DiffServ marks packets into classes and each hop applies a per-hop behaviour, with no per-flow state — which is why it scales where IntServ does not. DSCP is 6 bits in the IP header at layer 3; CoS is 3 bits in the VLAN tag at layer 2 and is lost off the trunk. EF is 46 and carries voice. Set the trust boundary so hosts cannot mark their own traffic as priority. QoS only matters under congestion.

Related reading: Traffic shaping and QoS · Traffic policing · Control, data and management planes