QoS Marking & Queuing: DSCP, Trust Boundaries, LLQ, CBWFQ

The one-sentence mental model

QoS is what a router does when the outbound interface is congested. If the pipe isn’t full, QoS doesn’t do anything you’d notice. Once it fills, QoS decides: which packets keep going (voice, video), which get held (bulk file transfer), which get dropped (scavenger).

The four QoS steps

1. Classify

Identify what kind of traffic a packet is. Techniques:

• Match a Layer-2 CoS bit (802.1p priority in a trunk frame)
• Match an ACL
• Match a DSCP already set by an upstream device you trust
• Match NBAR2 deep-packet inspection results

Cisco best practice: on access switches, classify once at ingress and mark. Everywhere downstream just trusts the mark.

2. Mark

Write a value into the packet so every downstream hop can classify quickly (a single header lookup instead of an ACL re-match).

• CoS (802.1p): 3 bits in a trunk frame’s 802.1Q tag. Values 0 to 7.
• DSCP (RFC 2474): 6 bits in the IP DiffServ / ToS byte. Values 0 to 63.
• IP Precedence (legacy): 3 bits, values 0 to 7. Superseded by DSCP but still shown by show.

DSCP values you’ll see in every design guide:

3. Queue

The router maintains multiple queues on each interface. As packets arrive, classification decides which queue to drop them into. Bulk goes to one queue, voice to another, signaling to a third.

Queue depth matters: a queue that never fills doesn’t need managing. A queue that always overflows means the class is oversubscribed.

4. Schedule

The scheduler decides which queue to service next when the outbound line is free.

• FIFO: no QoS. One queue.
• Priority Queuing (PQ): strict priority. High queue always served first. High can starve low.
• Weighted Fair Queuing (WFQ): automatic per-flow fair-share.
• CBWFQ (Class-Based Weighted Fair Queuing): you define classes and bandwidth guarantees per class.
• LLQ (Low Latency Queuing) = CBWFQ + one strict-priority queue for voice, but the priority queue is rate-limited so it can’t monopolize the interface. This is the classic modern QoS scheduler.

Trust boundaries

If a laptop plugs into an access port and marks all its traffic DSCP 46 (voice priority), it’s stealing bandwidth. So trust matters:

• On an IP phone, trust the phone’s own CoS marking (it knows the difference between its own voice and the PC-connected-behind-it’s data).
• On an access port for a normal PC, don’t trust, re-mark all incoming traffic to DSCP 0.
• On switch uplinks and router WAN interfaces, trust the DSCP already in the packet (upstream did the classification).

Interface command switchport priority extend cos 0: tells an IP phone to strip the CoS on frames coming from its data port (the PC connected behind it).

Sample LLQ + CBWFQ

class-map match-any VOICE
  match ip dscp ef
!
class-map match-any SIGNALING
  match ip dscp cs3
!
class-map match-any INTERACTIVE
  match ip dscp af21
!
policy-map WAN-EGRESS
  class VOICE
    priority percent 30            ! LLQ: up to 30% of link, strict priority
  class SIGNALING
    bandwidth percent 5
  class INTERACTIVE
    bandwidth percent 25
  class class-default
    fair-queue
    random-detect                  ! WRED: drop before full
!
interface GigabitEthernet0/1
  service-policy output WAN-EGRESS

Verify with:

show policy-map interface GigabitEthernet0/1

Look at the “packets output” and “drops” counters per class to know if your bandwidth reservations match reality.

Common exam / real-world mistakes

1. Marking without a policy on the WAN egress. Marking DSCP does nothing on its own. Some interface must actually queue and schedule by DSCP for the mark to matter.
2. Trusting endpoints blindly. Users’ laptops WILL mark their own traffic if you let them. Re-mark at the access edge.
3. Setting the LLQ priority too high. If voice takes 60% of the link, everything else stalls. Cisco’s rule of thumb: don’t exceed 33% of link bandwidth in LLQ.
4. Forgetting to shape at the branch. MPLS carriers police at their PE, so the CE has to shape below the CIR (say, to 95%) to avoid the carrier’s police drops.
5. Confusing bandwidth (guaranteed minimum) with priority (strict). bandwidth percent 25 = 25% guaranteed under congestion, more allowed if idle. priority percent 25 = strict priority, policed at 25% under congestion. (Without percent, both values are in kbps.)

Cheat strip

4 steps    Classify → Mark → Queue → Schedule
Mark bits  CoS 3-bit (L2)  |  DSCP 6-bit (L3)  |  IP Prec 3-bit (legacy)
DSCP key   EF=46 voice  |  AF41=34 video  |  CS3=24 signaling  |  AF31=26 streaming
           AF21=18 transactional  |  AF11=10 bulk  |  BE=0 default

Trust      Phone: trust CoS. PC-only port: don't trust, remark to 0.
           Switch uplinks / WAN: trust DSCP (upstream classified).

LLQ        strict-priority + rate-limited. Voice only. Cap 33% link.
CBWFQ      per-class bandwidth guarantee under congestion.
WRED       drop-before-full in the default class.

Verify     show policy-map interface X
           show mls qos interface X  (on catalyst)