Classification and Marking

In networking, QoS classification and marking are the foundations of traffic prioritization. Classification helps you identify and group different types of traffic. Marking assigns values that determine how the network treats that traffic.

Classification is the process of identifying and organizing traffic into distinct classes.

For example, you might decide:

• "This traffic is critical for our business."

• "This traffic is not urgent and can wait."

• "This traffic is unrelated to business operations and should have the lowest priority."

In our example, traffic is divided into four classes:

Figure 1 – Traffic Classification

The diagram above shows how traffic coming into interface G0/0 is sorted by priority:

• Real-Time: Ensures smooth delivery of Voice over IP (VoIP) and video traffic.

• Business Critical: Prioritizes essential business services like server or application traffic.

• Best Effort: Handles standard traffic without any special priority, such as web browsing or emails.

• Scavenger: Low-priority traffic, typically entertainment or non-business-related activities.

Classifying traffic helps manage the network better. It makes sure important operations come first. This way, less critical tasks won't impact them.

Why close to the source? Classifying and marking traffic near the source helps prioritize it correctly when it enters the network. This avoids unnecessary delays or mismanagement of resources further along the packet's journey.

How to Classify Traffic

Traffic classification can be achieved using various methods. Here are the two most common approaches:

Figure 2 – IOS Methods of Traffic Classification

Using ACLs (Access Control Lists):

• ACLs define rules to identify specific types of traffic on a network device.

• For instance, you could create an ACL to classify traffic originating from a subnet hosting critical servers, ensuring that this traffic receives higher priority.

Using NBAR (Network-Based Application Recognition):

• NBAR employs deep packet inspection to identify traffic by applications, protocols, or services.

• This method is particularly useful when traffic patterns are complex or involve a variety of applications.

Once traffic has been classified into different classes, the next step is marking.

This means giving each class a specific value. This helps network devices find and prioritize traffic based on the value in the packet header.

Marking Using Values

Below is an example where traffic is assigned specific values. (If you're not familiar with these values yet, don’t worry! We’ll cover them in detail later in this lesson.)

Figure 3 – Classification & Marking

After a packet is marked, routers and switches just read the marking value. This tells them the traffic’s priority without needing to reclassify it.

Figure 4 – Marking vs Matching

Methods of Marking Traffic

To implement marking, various methods can be used depending on the layer:

• Layer 2 Marking (Data Link Layer)

• Layer 3 Marking (Network Layer)

Let’s start by exploring Layer 2 Marking in detail!

What is PCP?

PCP (Priority Code Point) is a 3-bit field in the 802.1Q tag found in Ethernet frames.
It is used for Layer 2 QoS marking, allowing devices to categorize and prioritize traffic directly at the Ethernet frame level.

Figure 5 – PCP Field in 802.1Q for Layer 2 Marking

Understanding PCP Values

PCP, also called CoS (Class of Service), uses 3 bits, allowing for 8 possible values (0–7). However, Cisco reserves values 6 and 7 for internal use by network control protocols, such as routing protocol updates. These values are key. They make sure routing protocols get top priority, free from other traffic interference.

Figure 6 – PCP Values and Traffic Priority

The recommended PCP value for real-time traffic, such as VoIP, is 5, which ensures high priority while avoiding the reserved values.

Since the 802.1Q header is not included in all Ethernet frames, PCP marking only works when 802.1Q trunking is enabled on a link.

PCP in Practice

Let's consider the scenario below: the switch has a trunk port that allows traffic to be sent with a Layer 2 PCP marking.

Figure 7 – PCP in Practice (Layer 2 QoS Marking and Trunk Links)

For example, traffic between a server on the left and a server behind R1 is classified as business-critical and assigned a PCP value of 3. This marking remains valid only on the trunk link.

However, once the Ethernet frame reaches the first router, the router replaces the Ethernet header, causing the PCP value to be lost.

Limitation of PCP Marking:

1. Headers are replaced at each hop: Routers replace the source and destination MAC addresses for the next segment of the journey, removing the original Ethernet frame and any PCP markings.

2. Marking doesn't persist end-to-end: Since Layer 2 information is lost, prioritization does not continue beyond the first router.

To address these challenges, Layer 3 marking (DSCP) is required to ensure prioritization persists across the entire network path.

Layer 3 marking adds priority info to the IP header. This helps routers prioritize traffic consistently from source to destination.

Layer 2 marking (PCP) is linked to Ethernet frames. It gets replaced when these frames reach a router. In contrast, Layer 3 markings stay with the packet for its entire journey. This helps maintain end-to-end QoS.

How Layer 3 Marking Works

When a host sends data, the IP packet is encapsulated within a data-link frame. As the packet travels through the network:

1. Routers replace the data-link header at each hop with a new one for the next link.

2. The IP header remains unchanged, preserving the Layer 3 QoS marking.

Real-World Example: End-to-End Consistency

Imagine a server on the left sending traffic to another server across multiple routers (R1 and R2). At R1, the packet is marked with a Layer 3 DSCP value. This marking persists all the way to the destination, ensuring consistent traffic prioritization.

Figure 8 – Real-World Example: End-to-End Consistency with DSCP

IPP (Old Use)

In earlier implementations of IPv4, the Type of Service (ToS) byte included a 3-bit IP Precedence (IPP) field for marking traffic priority. This provided 8 possible values (0–7), similar to PCP at Layer 2.

Figure 9 – IP Precedence (Old ToS Field in IPv4 Header)

⚠️ Warning: Like PCP, values 6 and 7 are reserved by Cisco for internal use by network control protocols, such as OSPF and BGP.

IPP Values:

Table 1 – IPP Values

💡 Like PCP, set the IPP value for real-time traffic to 5. This gives high priority to latency-sensitive apps, such as voice.

Why IPP Became Obsolete

IPP was helpful, but its 3-bit field only offered 8 values. This wasn't enough for today's complex networks. A later RFC changed the ToS byte to include the DSCP (Differentiated Services Code Point) field. This change adds more flexibility.

DSCP (Current Use)

To address IPP’s limitations, DSCP (Differentiated Services Code Point) was introduced. DSCP uses 6 bits from the ToS (Type of Service) field in the IP header, allowing for 64 possible values (0 to 63). This expanded range offers much greater flexibility for prioritizing traffic.

Figure 10 – DSCP Field

DSCP: Standardization for Interoperability
While DSCP offers 64 possible values, unregulated use could lead to inconsistencies across networks. To address this, the IETF standardized 21 commonly used values as Per-Hop Behaviors (PHB), which define how traffic should be handled by routers.

Key Standardized DSCP Values:

Table 2 – Standardized DSCP Values

Expedited Forwarding (EF) for Real-Time Traffic

The EF (Expedited Forwarding) DSCP value 46 is reserved for latency-sensitive applications like Voice over IP (VoIP). This ensures that such traffic is prioritized across the network, minimizing delays.

Beyond Class Selectors: Assured Forwarding (AF)

DSCP also introduced Assured Forwarding (AF) for more granular traffic management. AF values categorize traffic based on:

1. Priority Class (1–4): Overall importance of the traffic.

2. Drop Probability (Low, Medium, High): Likelihood of traffic being dropped during congestion.

Interpreting AF Markings:

• A DSCP value of AF31 (011010 in binary) represents:

  • Priority Class: 3 (011).

  • Drop Probability: Low (01).

Traffic marked with AF31 is treated as important but has a lower risk of being dropped compared to medium or high drop probabilities.

Backward Compatibility with IPP

DSCP values are designed to be backward-compatible with legacy IPP systems. For devices that only understand IPP, the router interprets the first 3 bits of the DSCP value as an IPP value.

Example: DSCP to IPP Mapping:

• A DSCP value of 46 (EF) maps to IPP value 5, ensuring high-priority treatment for delay-sensitive traffic on older systems.

In this lesson, we explored the core elements of Quality of Service (QoS). The key takeaways are:

Classification → Identifying and grouping traffic into categories such as Real-Time, Business-Critical, Best Effort, and Scavenger.

• You can use ACLs for rule-based filtering or NBAR for deep packet inspection by applications and protocols.
  

Marking → Assigning values to traffic so that it can be prioritized across the network.

• Layer 2 Marking (PCP) works at the Ethernet frame level but remains limited to local segments.

• Layer 3 Marking (DSCP) allows for end-to-end prioritization. It offers more flexibility and granularity, and it works well with older systems.

Classification and marking are key to QoS. They make sure critical applications get the network performance they need.