DSCP / CoS Converter

The DSCP Field in the IP Header

Quality of Service (QoS) in IP networks relies on a single byte inside every IP packet header known as the Differentiated Services (DS) field — historically called the Type of Service (ToS) byte. Of these 8 bits, the 6 most significant bits form the DSCP (Differentiated Services Code Point). The remaining 2 bits are used by ECN (Explicit Congestion Notification) and are not part of the QoS marking.

The ToS byte decimal value you see in packet captures is therefore the DSCP value left-shifted by 2 (i.e. multiplied by 4), with the ECN bits set to zero. For example, EF (DSCP 46) gives a ToS byte of 46 × 4 = 184 (0xB8). When a device reports a ToS value with ECN bits set, you mask off the lower 2 bits with a bitwise AND of 0xFC before mapping to DSCP.

With 6 bits available, DSCP can encode 64 distinct values (0–63). Not all 64 are defined by the IETF — only three Per-Hop Behavior (PHB) groups are standardized: Default/Best Effort (BE), Expedited Forwarding (EF), and Assured Forwarding (AF). Class Selectors (CS0–CS7) provide backward compatibility with the older 3-bit IP Precedence field.

Per-Hop Behavior (PHB): Routers Act Independently

A critical concept in DiffServ is that DSCP markings carry meaning only at each individual router. There is no end-to-end signaling protocol — every router or switch simply reads the DSCP field and applies its locally configured treatment (queuing, scheduling, dropping policy). This is what "Per-Hop Behavior" means: the forwarding decision is made independently at each hop along the path.

This design keeps the network core simple and scalable. The intelligence lives in the policy configurations at each device rather than in a centralized reservation system (like IntServ/RSVP). For QoS to work end-to-end, every device in the path must be consistently configured to honor the same DSCP markings.

Expedited Forwarding (EF) — DSCP 46

Defined in RFC 3246, EF is the highest-priority PHB intended for traffic that is extremely delay-sensitive and low-latency: VoIP RTP bearer streams. EF is implemented via a strict-priority queue that is served before any other queue. The key requirement is that the EF queue must drain faster than it fills — meaning EF traffic must be rate-limited (policed) to prevent it from starving other queues.

EF maps to IP Precedence 5 and 802.1p CoS 5. In Cisco IOS you mark traffic as EF with set dscp ef in a policy-map. Voice RTP should be marked EF; signaling traffic (SIP, H.323) is typically marked CS3 or AF31, not EF.

Assured Forwarding (AF): Four Classes, Three Drop Precedences

Defined in RFC 2597, the AF PHB group provides four independent forwarding classes (AF1x through AF4x), each with three drop precedence levels. This gives 12 distinct DSCP values (AF11 through AF43).

The formula is: DSCP = 8x + 2y, where x is the AF class (1–4) and y is the drop precedence (1 = low, 2 = medium, 3 = high). AF11 = 10, AF12 = 12, AF13 = 14, AF21 = 18, and so on.

Within a single AF class, all three drop precedences share the same forwarding class (same queue), but during congestion, packets with higher drop precedence are discarded first. For example, if the AF4x queue is congested, AF43 packets are dropped before AF42, and AF42 before AF41. This allows traffic engineering to differentiate within a class — e.g., premium video subscribers at AF41 and standard subscribers at AF43.

Traffic in different AF classes (AF1x vs AF4x) has no ordering relationship — AF4x does not inherently have priority over AF1x. Priority between classes is determined by your queuing policy (CBWFQ or LLQ bandwidth allocations).

Class Selectors (CS): IP Precedence Compatibility

Before DSCP, IP networks used a 3-bit IP Precedence (IPP) field in the ToS byte (bits 7–5, the three most significant bits). Values ranged 0–7, with higher numbers indicating more important traffic.

The DiffServ architecture preserves backward compatibility through Class Selectors. CS0 through CS7 are DSCP values 0, 8, 16, 24, 32, 40, 48, and 56 respectively — calculated as DSCP = 8 × IPP. The three most significant bits of a CS DSCP value equal the original IP Precedence, so legacy devices that only read the IPP field will see the correct relative priority.

CS6 (DSCP 48) and CS7 (DSCP 56) are reserved for network control traffic (routing protocols like OSPF, BGP, EIGRP). These must never be used for user data traffic. Cisco IOS marks routing protocol packets CS6 by default.

CoS (802.1p): Layer 2 QoS in Ethernet Frames

While DSCP operates at Layer 3 (the IP header), 802.1p CoS is a Layer 2 QoS marking carried inside the 802.1Q VLAN tag. The 802.1Q tag adds a 4-byte field to the Ethernet frame; 3 of those bits (bits 15–13 of the Tag Control Information) form the Priority Code Point (PCP), commonly called CoS. This gives 8 possible values (0–7), where 7 is highest priority and 0 is best effort.

CoS markings are relevant only on 802.1Q-tagged frames (trunk links and access ports carrying VLANs). They are stripped when a frame leaves the VLAN domain. On routed interfaces, DSCP carries the QoS marking across Layer 3 boundaries. At trust boundaries, QoS policies translate between CoS and DSCP.

The standard CoS-to-DSCP mapping used by Cisco is: CoS 0 → CS0 (DSCP 0), CoS 1 → AF11 (DSCP 10), CoS 2 → AF21 (DSCP 18), CoS 3 → CS3 (DSCP 24), CoS 4 → AF41 (DSCP 34), CoS 5 → EF (DSCP 46), CoS 6 → CS6 (DSCP 48), CoS 7 → CS7 (DSCP 56).

Trust Boundaries: Where DSCP Remarking Happens

A trust boundary is the point in the network where incoming DSCP/CoS markings are either accepted as valid or overwritten. Endpoints (PCs, phones, laptops) are generally not trusted — they can mark their own traffic with any DSCP value, including EF, which would give them unfair priority.

The trust boundary is typically the access layer switch port where an endpoint connects. The switch can be configured to either:

• Trust the marking — for IP phones and managed devices that correctly mark traffic
• Remark/police — overwrite the DSCP to a safe value (e.g., CS0) for unmanaged PCs

Some access switches support "trust DSCP only if the connected device is a Cisco IP phone" (using CDP to detect the phone). This allows the phone's voice traffic (marked EF) to be trusted while the PC behind the phone has its markings reset.

Cisco IOS Configuration Commands

Enabling QoS on Cisco Catalyst switches requires mls qos globally (on older IOS platforms). On IOS-XE/NX-OS, MQC (Modular QoS CLI) is used:

! Identify VoIP RTP traffic
class-map match-all VOICE-RTP
 match ip dscp ef

! Identify SIP signaling
class-map match-all VOICE-SIGNALING
 match ip dscp cs3

! Policy: strict priority for voice, guaranteed BW for signaling
policy-map QOS-POLICY
 class VOICE-RTP
  priority percent 20
 class VOICE-SIGNALING
  bandwidth percent 5
  set dscp cs3
 class class-default
  fair-queue

! Apply to interface
interface GigabitEthernet0/1
 service-policy output QOS-POLICY

! Mark traffic at ingress
policy-map MARK-INGRESS
 class VOICE-RTP
  set dscp ef
 class class-default
  set dscp default

Worked Example: Classifying VoIP Traffic End-to-End

Consider a Cisco IP phone (model 8861) connected to an access switch. Here is the end-to-end QoS flow:

1. Phone marks traffic: The phone hardware marks voice RTP packets with DSCP EF (46) and SIP signaling with DSCP CS3 (24). It also sets 802.1p CoS 5 on the voice VLAN.
2. Access switch trust: The switch port is configured with mls qos trust dscp (or auto qos voip cisco-phone). The phone's markings are preserved; if a PC plugged into the phone's built-in switch sends EF-marked traffic, the switch re-marks it to CS0.
3. Distribution / core: Upstream switches and routers read the DSCP field and place EF packets in the strict-priority queue, ensuring sub-150ms one-way latency for voice.
4. WAN edge: The WAN QoS policy uses LLQ (Low Latency Queuing) to guarantee bandwidth for EF traffic. Voice is policed to ensure it does not exceed its allocated bandwidth.
5. Remote site: The remote access switch honors the DSCP markings and delivers the packets to the remote phone with consistent low-latency treatment.

The result is predictable voice quality: less than 150ms one-way delay, less than 30ms jitter, and less than 1% packet loss — meeting the G.114 recommendation for toll-quality voice.

Frequently Asked Questions

Q: What is the difference between DSCP and ToS?

The ToS byte and the Differentiated Services (DS) byte occupy the same position in the IPv4 header. The original RFC 791 ToS interpretation used 3 bits for IP Precedence plus 4 precedence bits. RFC 2474 redefined the same byte as the DS field, using 6 bits for DSCP and 2 for ECN. Modern networks use the DS/DSCP interpretation. The ToS decimal value you see in captures equals DSCP × 4 (when ECN bits are 0).

Q: Does DSCP marking guarantee QoS?

No. DSCP is just a label — it only means something if every device in the path is configured to honor it with appropriate queuing, scheduling, and policing policies. In a network where no QoS policies are configured, DSCP markings are ignored and all traffic is treated as best-effort.

Q: Why do VoIP phones mark signaling as CS3 and not EF?

EF requires strict-priority queuing and should be reserved for the actual voice RTP media stream, which is extremely delay-sensitive. SIP signaling (INVITE, BYE, etc.) can tolerate slightly more delay and is call-setup traffic, not active media. Using EF for signaling would consume strict-priority queue bandwidth unnecessarily. CS3 gives signaling guaranteed bandwidth without monopolizing the strict-priority queue.

Q: What happens to CoS markings when a packet is routed?

802.1p CoS exists only in the Layer 2 Ethernet 802.1Q tag and is stripped at every Layer 3 hop. The DSCP value in the IP header survives routing and carries QoS information across Layer 3 boundaries. At ingress, the router maps incoming CoS to DSCP; at egress, it maps DSCP back to CoS for the outbound Layer 2 segment. This is why DSCP is the authoritative QoS marking in routed networks.

Q: What is DSCP VA (Voice Admit, DSCP 44)?

VA (Voice Admit) is defined in RFC 5865 as a variant of EF for VoIP that requires Call Admission Control (CAC). Traffic admitted by CAC is marked VA (DSCP 44) rather than EF (DSCP 46). The two values share the same PHB treatment (strict priority), but VA allows network equipment to distinguish CAC-controlled calls from calls that bypassed CAC — useful for capacity planning and policy enforcement. In practice, most deployments still use EF; VA is more common in carrier/service-provider environments.

Related Network Calculators

• Subnet Calculator — Calculate subnets, host ranges, and wildcard masks from CIDR notation
• OSPF Cost Calculator — Compute OSPF interface cost from bandwidth for optimal path selection
• ACL Wildcard Mask Tester — Verify Cisco ACL wildcard masks and match ranges