Enterprise Quality of Service: DiffServ, DSCP Marking & CBWFQ Shaping

1. DiffServ Architecture & The DSCP Marking Field

The IETF Differentiated Services (DiffServ) architecture replaced the legacy, unscalable Integrated Services (IntServ / RSVP) model. Instead of maintaining per-flow state across every router along a path, DiffServ classifies packets at the network trust boundary, marks a 6-bit field in the IP header, and enforces Per-Hop Behaviors (PHBs) statelessly at each routing hop:

The standard DSCP classification hierarchy includes:

• Expedited Forwarding (EF - DSCP 46 / Binary 101110): Reserved exclusively for real-time, delay-sensitive, jitter-intolerant traffic (Voice RTP audio streams). Enforces strict priority scheduling.
• Assured Forwarding (AFxy Classes, RFC 2597): Organized into 4 distinct classes (AF1 through AF4) with 3 levels of drop precedence within each class (Low, Medium, High drop probability). For example, AF41 (DSCP 34) is high-priority interactive video with low drop probability, whereas AF43 (DSCP 38) is video with higher drop probability during congestion.
• Class Selector (CS0 to CS7): Backward-compatible mappings to the legacy 3-bit IP Precedence values. CS6 (DSCP 48) and CS7 (DSCP 56) are reserved strictly for network control protocols (BGP, OSPF, SSH).
• Best Effort (BE / CS0 - DSCP 0): Standard default unclassified traffic.

2. Hardware Queuing: CBWFQ and Low Latency Queuing (LLQ)

When packets arrive at an egress interface faster than the physical line rate can transmit them, packets must enter hardware output queues. How those queues are serviced determines network behavior during congestion:

• Class-Based Weighted Fair Queuing (CBWFQ): Allocates guaranteed minimum bandwidth percentages to discrete user-defined traffic classes (e.g., 30% for Mission-Critical ERP, 20% for Web, 10% for Bulk Data). During periods of congestion, each class receives its mathematical share of bandwidth, preventing bandwidth starvation from runaway downloads.
• Low Latency Queuing (LLQ): Combines CBWFQ with a Strict Priority (PQ) queue. LLQ services the Priority Queue first before servicing any other CBWFQ queues. Voice traffic assigned to the LLQ queue is guaranteed immediate, sub-millisecond transmission. To prevent misconfigured voice traffic from starving all other business applications, the Priority Queue is bound to a strict policer that drops priority traffic exceeding the contracted limit.

3. Congestion Avoidance: WRED vs. Tail Drop

In standard FIFO queuing, when an output buffer becomes 100% full, the switch drops every subsequent incoming packet regardless of priority—a destructive condition known as Tail Drop. Tail drop causes hundreds of concurrent TCP flows to lose packets simultaneously. In response, all TCP senders execute exponential backoff at the identical second, causing overall link utilization to collapse, followed by simultaneous window expansion. This cyclic instability is known as TCP Global Synchronization.

Weighted Random Early Detection (WRED) eliminates global synchronization by monitoring the average queue depth. As buffer memory begins filling (e.g., reaching 60% capacity), WRED begins dropping a small percentage of TCP packets randomly. The dropped packets trigger TCP window throttling in individual sessions at staggered intervals, gracefully reducing transmission rates without causing widespread connection collapse. Furthermore, WRED drops packets with higher DSCP drop precedence (e.g., AF23) long before dropping low-precedence packets (AF21).

4. Traffic Conditioning: Policing vs. Traffic Shaping

Network engineers enforce bandwidth constraints using two fundamentally distinct mathematical algorithms:

5. Comprehensive DSCP Per-Hop Behavior (PHB) Mapping Reference

6. Production Configuration: Modular QoS CLI (MQC) on Cisco IOS-XE

Below is an enterprise Cisco IOS-XE Modular QoS CLI (MQC) configuration defining deep packet classification, LLQ strict priority voice queuing, CBWFQ bandwidth guarantees, and egress traffic shaping to match a 100 Mbps sub-rate WAN circuit:

! ==============================================================================
! Cisco IOS-XE Enterprise QoS Policy (MQC)
! ==============================================================================
class-map match-any CM_VOICE
 match dscp ef
 match protocol rtp audio
!
class-map match-any CM_VIDEO
 match dscp af41
!
class-map match-any CM_CRITICAL_DATA
 match dscp af31 af21
!
policy-map PM_QUEUING_SUB_POLICY
 class CM_VOICE
  priority level 1
  police cir 15000000
   conform-action transmit
   exceed-action drop
 !
 class CM_VIDEO
  bandwidth percent 25
  random-detect dscp-based
 !
 class CM_CRITICAL_DATA
  bandwidth percent 35
  random-detect dscp-based
 !
 class class-default
  fair-queue
  random-detect
!
policy-map PM_WAN_SHAPING_PARENT
 class class-default
  shape average 100000000
  service-policy PM_QUEUING_SUB_POLICY
!
interface GigabitEthernet0/0/1
 description WAN_CIRCUIT_100M_HANDOFF
 service-policy output PM_WAN_SHAPING_PARENT
!