Understanding IP Precedence, ToS, and DSCP

People using NetFlow Analyzer might wonder, What do these reports about DSCP and ToS actually mean? In this blog, we'll explain these fields in detail. The NetFlow packets exported from the device originally contain ToS value on each flow. Analysis software derives the DSCP from the ToS value.

Type of Service (ToS)

The ToS field, originally defined in RFC 791, is present in the IP header. The ToS octet consists of three fields. The last 3 bits (7, 6, 5) are for the first field, labeled "Precedence," intended to denote the importance or priority of the datagram. The second field, labeled "TOS," denotes how the network should make tradeoffs between throughput, delay, reliability, and cost. The first field, labeled "MBZ" (for "must be zero") above, is currently unused. The originator of a datagram sets this field to zero (unless participating in an Internet protocol experiment which makes use of that bit). Routers and recipients of datagrams ignore the value of this field. This field is copied on fragmentation.

Differentiated Services Code Point (DSCP)

The definition of ToS was changed entirely in RFC 2474, and it is now called Differentiated Service (DS). On the eight fields, the upper six bit contain value called Differentiated Services Code Point (DSCP). The last two bits are used for Explicit Congestion Notification and it is defined in RFC 3168.

Interpretation of ToS and DSCP fields

DSCP interpretation (RFC 2474)

RFC 791 and RFC 1349

In DSCP, the most significant three bits are directly proportional to IP Precedence. Below is a DSCP to IP Precedence conversion table.

DSCP Name	DS Field Value		IP Precedence
	Binary	Decimal
CS0	000 000	0	0
CS1	001 000	8	1
AF11	001 010	10	1
AF12	001 100	12	1
AF13	001 110	14	1
CS2	010 000	16	2
AF21	010 010	18	2
AF22	010 100	20	2
AF23	010 110	22	2
CS3	011 000	24	3
AF31	011 010	26	3
AF32	011 100	28	3
AF33 </t d>	011 110	30	3
CS4	100 000	32	4
AF41	100 010	34	4
AF42	100 100	36	4
AF43	100 110	38	4
CS5	101 000	40	5
EF	101 110	46	5
CS6	110 000	48	6
CS7	111 000	56	7

NetFlow Analyzer's DSCP and ToS reports

NetFlow Analyzer reports on both DSCP and ToS. The DSCP report generated from NetFlow Analyzer will show each DSCP marking traffic utilization and application and conversation marked for DSCP.The ToS report shows corresponding ToS values for each DSCP.Reference: http://bogpeople.com/networking/dscp.shtmlLearn what QoS baselines Cisco recommends.Download a 30-day, free trial of NetFlow Analyzer.  Download | Interactive demo | Customers