People using NetFlow Analyzer might wonder, What do these reports about DSCP and ToS actually mean? In this blog, we’ll explain these fields in detail.

The NetFlow packets exported from the device originally contain ToS value on each flow. Analysis software derives the DSCP from the ToS value.

Type of Service (ToS)

The ToS field, originally defined in RFC 791, is present in the IP header.

The ToS octet consists of three fields. The last 3 bits (7, 6, 5) are for the first field, labeled “Precedence,” intended to denote the importance or priority of the datagram. The second field, labeled “TOS,” denotes how the network should make tradeoffs between throughput, delay, reliability, and cost. The first field, labeled “MBZ” (for “must be zero”) above, is currently unused. The originator of a datagram sets this field to zero (unless participating in an Internet protocol experiment which makes use of that bit). Routers and recipients of datagrams ignore the value of this field. This field is copied on fragmentation.

Differentiated Services Code Point (DSCP)

The definition of ToS was changed entirely in RFC 2474, and it is now called Differentiated Service (DS). On the eight fields, the upper six bit contain value called Differentiated Services Code Point (DSCP). The last two bits are used for Explicit Congestion Notification and it is defined in RFC 3168.

Interpretation of ToS and DSCP fields

DSCP interpretation (RFC 2474)

RFC 791 and RFC 1349

In DSCP, the most significant three bits are directly proportional to IP Precedence. Below is a DSCP to IP Precedence conversion table.

DSCP Name DS Field Value IP Precedence
  Binary Decimal  
CS0 000 000 0 0
CS1 001 000 8 1
AF11 001 010 10 1
AF12 001 100 12 1
AF13 001 110 14 1
CS2 010 000 16 2
AF21 010 010 18 2
AF22 010 100 20 2
AF23 010 110 22 2
CS3 011 000 24 3
AF31 011 010 26 3
AF32 011 100 28 3
AF33 </t d> 011 110 30 3
CS4 100 000 32 4
AF41 100 010 34 4
AF42 100 100 36 4
AF43 100 110 38 4
CS5 101 000 40 5
EF 101 110 46 5
CS6 110 000 48 6
CS7 111 000 56 7

NetFlow Analyzer’s DSCP and ToS reports

NetFlow Analyzer reports on both DSCP and ToS. The DSCP report generated from NetFlow Analyzer will show each DSCP marking traffic utilization and application and conversation marked for DSCP.

The ToS report shows corresponding ToS values for each DSCP.

Reference: http://bogpeople.com/networking/dscp.shtml

Learn what QoS baselines Cisco recommends.

Download a 30-day, free trial of NetFlow Analyzer.

 

Download | Interactive demo | Customers

  1. Cijor Chen

    How to understand “N” and “H” is TOS?
    what does it mean “3 N H N N” ?

  2. expo

    thanks mate .. very well explained

  3. sunil

    Good Information in a simple, clear , short presentation. 🙂