DSCP marking explained: EF, AF classes and QoS

DSCP (Differentiated Services Code Point) marking is the foundation of modern QoS implementations. By assigning a 6-bit value to the IP header, DSCP tells network devices how to treat traffic: which packets to prioritize, which to drop first under congestion, and which to rate-limit. Understanding DSCP classes and marking strategies is essential for engineers designing networks that support voice, video, and critical applications alongside best-effort traffic.

What is DSCP and why it matters

DSCP replaced the older ToS (Type of Service) field and operates in the Differentiated Services architecture defined in RFC 2474. The 6-bit DSCP value (0-63) sits in the first six bits of the IP ToS octet, leaving 2 bits for ECN (Explicit Congestion Notification). Each DSCP value maps to a Per-Hop Behavior (PHB) that dictates how routers and switches handle that packet at each hop. Without DSCP marking, all traffic receives identical treatment regardless of business importance or application requirements.

DSCP classes: EF and AF explained

The two primary DSCP class families are Expedited Forwarding (EF) and Assured Forwarding (AF). EF is a single, low-latency class designed for real-time traffic like VoIP and video conferencing. AF comprises four classes (AF1 through AF4), each subdivided into three drop precedence levels (high, medium, low). This structure lets you mark traffic with both its service level and drop priority.

• →EF (46): Expedited Forwarding - minimal latency, jitter, and loss for VoIP, video calls, and real-time applications
• →AF4 (34, 36, 38): High-assurance class for interactive video and streaming
• →AF3 (26, 28, 30): Transactional data (databases, financial systems)
• →AF2 (18, 20, 22): Standard business applications
• →AF1 (10, 12, 14): Best-effort and bulk data transfer
• →CS0 (0): Default best-effort (no special treatment)

Each AF class has three drop precedence levels. For example, AF41 (34) is AF4 with low drop precedence, AF42 (36) is medium, and AF43 (38) is high. Under congestion, AF43 packets are dropped first; AF41 packets are dropped last. This lets you mark premium traffic within a class to survive congestion better than standard traffic in the same class.

Marking strategies and practical implementation

DSCP marking occurs at ingress: either at the source device (end-to-end marking) or at the network edge (ingress policy marking). Most enterprises use edge marking for consistency and control. A typical marking policy inspects Layer 4 ports, application signatures, or VLAN tags and rewrites the DSCP field before traffic enters the core network.

! Cisco IOS example: mark VoIP traffic as EF
class-map match-any VOIP
  match ip dscp ef
  match protocol rtp audio

policy-map MARK_QOS
  class VOIP
    set ip dscp ef
  class AF3_APPS
    set ip dscp af31
  class default
    set ip dscp default

interface GigabitEthernet0/0/1
  service-policy input MARK_QOS

Once marked, DSCP values persist across the network (assuming trust boundaries are respected). Queuing policies at congestion points use DSCP to sort traffic into priority queues. Low-latency queues serve EF packets first; separate queues handle each AF class. Tail-drop or WRED (Weighted Random Early Detection) uses drop precedence to shed excess AF traffic before the queue overflows.

Common DSCP values quick reference

• →46 (EF): Voice, video conferencing - strict priority
• →34-38 (AF4): High-priority applications
• →26-30 (AF3): Business-critical data
• →18-22 (AF2): Standard applications
• →10-14 (AF1): Bulk and best-effort
• →0 (CS0/BE): Default, no QoS treatment
• →56 (CS7): Network control (BGP, OSPF)

Proper DSCP marking is the first step toward predictable network behavior. By classifying traffic at the edge and trusting DSCP values in the core, you build a QoS architecture that scales. The key is consistency: mark once at ingress, trust throughout the network, and apply queue policies that honor those marks.