Quality of Service: Classification, Marking, Queuing and Policing

Quality of Service does not create bandwidth. It decides who suffers when there is not enough. Every QoS design is a statement about which traffic the business is willing to drop or delay, and the technical machinery exists only to carry out that decision reliably.

What Traffic Actually Needs

Three measurements, and different applications care about different ones:

• Bandwidth — how much capacity. A file transfer wants a lot and does not care when it gets it.
• Latency — one-way delay. Voice needs under about 150 milliseconds before conversation becomes awkward.
• Jitter — variation in latency. Voice and video tolerate a consistent delay far better than an inconsistent one, because a jitter buffer can absorb the former.

Loss matters too, but differently: a retransmitted file is fine, a retransmitted voice packet is useless because it arrives after its moment.

The Four Steps

Classification identifies traffic — by port, protocol, source, or deep inspection of the payload.

Marking writes that decision into the packet so downstream devices do not have to repeat the work. Two markings matter:

• CoS (Class of Service) is a 3-bit field in the 802.1Q VLAN tag — layer 2 only, and lost the moment a frame crosses a router or leaves a tagged link.
• DSCP (Differentiated Services Code Point) is a 6-bit field in the IP header — layer 3, and survives routing. This is the one that matters end to end.

Standard DSCP values worth recognizing: EF (Expedited Forwarding, 46) for voice; AF41 (34) for interactive video; CS6 (48) for routing protocols; 0 for best effort.

Queuing decides transmission order when the interface is congested. Common schemes: priority queuing, which always serves the high-priority queue first and can starve everything else; weighted fair queuing, which allocates proportionally; and low-latency queuing, which combines a strict priority queue for voice with weighted allocation for everything else. LLQ is the usual answer for voice, and the priority queue is rate-limited precisely so it cannot starve the rest.

Policing and shaping both enforce a rate, and the difference is a standard exam question. Policing drops or re-marks traffic above the limit — no delay, no buffering, immediate. Shaping buffers excess traffic and releases it at the configured rate — adds latency, avoids loss. Shape traffic you are sending, police traffic you are receiving.

The Trust Boundary

This is the security-relevant part, and it is where QoS designs most often go wrong.

Any device can mark its own packets. Nothing stops a workstation from setting DSCP EF on everything it sends, claiming voice priority for a file download or a denial-of-service flood.

The trust boundary is the point where the network stops believing markings from outside and starts imposing its own. On an access switch the sensible policy is to trust markings from an IP phone on the voice VLAN, and to re-mark everything from the attached workstation to best effort. Set the boundary too far out and QoS becomes a resource an attacker can claim; set it too far in and legitimate markings are discarded.

Voice is normally placed on its own VLAN, which makes the boundary easy to express and also limits what a compromised workstation can reach — the same reasoning behind segmenting SIP signalling and RTP media away from general user traffic.

QoS Is Hop by Hop

Markings only mean something where a device is configured to act on them. An unconfigured switch in the middle forwards EF-marked voice exactly like a backup job. And across the public internet your DSCP values are routinely rewritten or ignored, which is why end-to-end QoS requires either your own links or a provider contract that honors the marking — a point worth checking before assuming it works across a WAN.

Exam Focus

Know CoS is layer 2 in the 802.1Q tag and DSCP is layer 3 in the IP header. Know EF is voice. Know policing drops while shaping buffers. Know the trust boundary decides whose markings are believed. Given choppy audio with adequate bandwidth, answer jitter. And know QoS must be configured on every hop in the path to have any effect at all.