People using NetFlow Analyzer might wonder, What do these reports about DSCP and ToS actually mean? In this blog, we’ll explain these fields in detail.
The NetFlow packets exported from the device originally contain ToS value on each flow. Analysis software derives the DSCP from the ToS value.
Type of Service (ToS)
The ToS field, originally defined in RFC 791, is present in the IP header.
The ToS octet consists of three fields. The last 3 bits (7, 6, 5) are for the first field, labeled “Precedence,” intended to denote the importance or priority of the datagram. The second field, labeled “TOS,” denotes how the network should make tradeoffs between throughput, delay, reliability, and cost. The first field, labeled “MBZ” (for “must be zero”) above, is currently unused. The originator of a datagram sets this field to zero (unless participating in an Internet protocol experiment which makes use of that bit). Routers and recipients of datagrams ignore the value of this field. This field is copied on fragmentation.
Differentiated Services Code Point (DSCP)
The definition of ToS was changed entirely in RFC 2474, and it is now called Differentiated Service (DS). On the eight fields, the upper six bit contain value called Differentiated Services Code Point (DSCP). The last two bits are used for Explicit Congestion Notification and it is defined in RFC 3168.
Interpretation of ToS and DSCP fields
DSCP interpretation (RFC 2474)
RFC 791 and RFC 1349
In DSCP, the most significant three bits are directly proportional to IP Precedence. Below is a DSCP to IP Precedence conversion table.
| DSCP Name | DS Field Value | IP Precedence | |
| Binary | Decimal | ||
| CS0 | 000 000 | 0 | 0 |
| CS1 | 001 000 | 8 | 1 |
| AF11 | 001 010 | 10 | 1 |
| AF12 | 001 100 | 12 | 1 |
| AF13 | 001 110 | 14 | 1 |
| CS2 | 010 000 | 16 | 2 |
| AF21 | 010 010 | 18 | 2 |
| AF22 | 010 100 | 20 | 2 |
| AF23 | 010 110 | 22 | 2 |
| CS3 | 011 000 | 24 | 3 |
| AF31 | 011 010 | 26 | 3 |
| AF32 | 011 100 | 28 | 3 |
| AF33 </t d> | 011 110 | 30 | 3 |
| CS4 | 100 000 | 32 | 4 |
| AF41 | 100 010 | 34 | 4 |
| AF42 | 100 100 | 36 | 4 |
| AF43 | 100 110 | 38 | 4 |
| CS5 | 101 000 | 40 | 5 |
| EF | 101 110 | 46 | 5 |
| CS6 | 110 000 | 48 | 6 |
| CS7 | 111 000 | 56 | 7 |
NetFlow Analyzer’s DSCP and ToS reports
NetFlow Analyzer reports on both DSCP and ToS. The DSCP report generated from NetFlow Analyzer will show each DSCP marking traffic utilization and application and conversation marked for DSCP.
The ToS report shows corresponding ToS values for each DSCP.
Reference: http://bogpeople.com/networking/dscp.shtml
Learn what QoS baselines Cisco recommends.
Download a 30-day, free trial of NetFlow Analyzer.
How to understand “N” and “H” is TOS?
what does it mean “3 N H N N” ?
thanks mate .. very well explained
Good Information in a simple, clear , short presentation. 🙂