IP Precedence and DSCP values: CS, AF and EF classes and how to decode them

One byte, two meanings

The second byte of the IPv4 header, and the Traffic Class byte of IPv6, carries the QoS marking. Its meaning has changed over time, which is why you still see both names in configuration and captures.

IP Precedence used the top three bits, giving eight values. 0 was routine traffic, 5 was "critical" (used for voice), and 6 and 7 were reserved for network control traffic such as routing protocols. Eight levels proved too coarse, so RFC 2474 redefined the top six bits as the Differentiated Services Code Point (DSCP), with 64 possible values. The two remaining bits became Explicit Congestion Notification (ECN), which lets routers signal congestion without dropping packets.

The three families of DSCP values

Two formulas cover almost everything:

• Class selector: CSx = 8 x x. So CS3 = 24 and CS6 = 48.
• Assured forwarding: AFxy = 8x + 2y. So AF41 = 34, AF31 = 26 and AF13 = 14.

Within an AF class, a higher y means "drop me first". If a provider polices video and finds it over its rate, it can re-mark AF41 to AF42 rather than dropping it; later, if a queue fills, AF42 packets go before AF41.

Converting between decimal, binary and ToS

Capture tools and some devices show the whole byte instead of the DSCP. Because DSCP sits in the top six bits, the ToS byte value is the DSCP multiplied by four (shifted left two bits):

Notice that the first three bits of a DSCP value equal the old precedence. A device that only understands precedence still treats EF traffic as precedence 5.

Layer 2 marking and common choices

Switches forwarding frames inside a VLAN may not look at the IP header, so the 802.1Q tag has its own 3-bit Class of Service (CoS) field, also called Priority Code Point (PCP). CoS is lost when the tag is removed, so DSCP is the marking that survives end to end. Switches map between them, for example CoS 5 to EF.

RFC 4594 suggests a common set of classes. Many enterprises use a simplified version:

• EF: voice media.
• AF41: interactive video such as video calls.
• CS3: call signalling (SIP).
• AF21: business applications that users wait on.
• CS6: routing protocols and network control.
• AF11 or CS1: bulk transfers and scavenger traffic. RFC 8622 also defines a "lower effort" value, DSCP 1, for traffic that should only use spare capacity.

Real-world example: an engineer at a university reviewed a packet capture from a lecture hall where video conferencing was choppy. The capture tool showed "DSField 0x88". Dividing 136 by four gave DSCP 34, which is AF41, so the conferencing client was marking correctly. The next capture, taken on the far side of the campus firewall, showed 0x00: the firewall was resetting markings. Allowing the firewall to preserve DSCP fixed the problem.