Quality of service, or QoS, is a set of network techniques that treat some traffic better than other traffic when a link is busy. The standard method on IP networks is Differentiated Services: packets carry a 6-bit marking, called the DSCP, and routers use it to pick a queue and a forwarding behavior.
What does a DSCP mark actually do?
RFC 2474 defines the DS field, which replaces the old IPv4 type-of-service octet and the IPv6 traffic class octet. Six bits of it form the differentiated services codepoint, DSCP, and the other two are currently unused. Each router matches the entire 6-bit value to select a per-hop behavior, which is how that packet is queued and forwarded at that hop.
The design goal in the RFC's abstract is scalable service differentiation without per-flow state and signaling at every hop. In short: mark at the edge, let the core read the mark, and avoid tracking every conversation.
RFC 2474 also states that mapping codepoints to behaviors must be configurable. A mark means what your domain says it means. That is useful, and it is why two networks can disagree about the same number.
Which service classes should you start with?
RFC 4594, an informational guideline, describes service classes and how to build them with DSCPs, traffic conditioners, per-hop behaviors and queue management. It says there is no intrinsic requirement to use particular values for a class, but using them consistently helps interoperability.
Two of its statements are practical. The default "standard" class is required and all others are optional. And administrators are expected to start with three or four classes for user traffic and add more as the need arises. The guideline's list includes classes for network control traffic, telephony, real-time interactive traffic, multimedia streaming, high-throughput data and low-priority data.
Why does voice get special handling?
RFC 4594 describes voice as an inelastic real-time application: it sends packets at the rate the codec produces them, regardless of available capacity. Because of that, a low-delay service "has the potential to disrupt or congest a network if not controlled" and also "has the potential for abuse." The document says to police that traffic at various points, so a priority queue is not overrun, and to police voice at ingress to keep it within negotiated bounds.
This is the security point most QoS articles skip. A mark is a claim made by the sender. If any device on the network can mark its own packets as top priority, it can take bandwidth from everything else. Priority has to be granted by policy at the boundary, with rate limits, not trusted from the host.
A constructed example
An office has a 100 Mbps internet link. Video calls stutter whenever a backup job runs. The network team creates three classes: interactive voice and video, business applications, and everything else including backups. They mark call traffic at the access switch, police that class to a fixed share, and re-mark anything arriving from guest Wi-Fi to the default class. A developer who sets a high DSCP on a file-transfer tool gets ignored at the edge, which is the point.
When does QoS not help?
QoS only matters when there is congestion. On an underused link, every class gets what it needs. It also cannot create bandwidth: if the voice class itself exceeds capacity, calls fail. RFC 4594 notes that telephony is often configured with over-subscription, so some users may be unable to place a call at peak periods, and that admission control mechanisms can address that.
Marks only mean something inside a domain that agrees on them. RFC 2474 says services may be end to end or intra-domain, so across providers you need an agreement about what each mark means. NIST's enterprise network guide notes SD-WAN products aim to choose paths using application type and network load, reducing jitter, latency and packet loss, which is QoS goals delivered by different mechanisms.
How to check or apply this
- List the applications that suffer under congestion and rank them by business need.
- Define three or four classes, not twelve.
- Mark traffic at the network edge and re-mark anything arriving from untrusted segments.
- Police the priority class with a rate limit and a queue size.
- Verify with packet captures that marks survive each hop you control.
- Monitor queue drops per class, then adjust.
Quick check
How many bits is a DSCP?
Six, according to RFC 2474. The DS field is eight bits and the remaining two are currently unused.
Can any host mark its traffic as high priority?
It can set the bits, but a well-run network re-marks or polices at the edge. RFC 4594 says to police priority traffic to prevent overload and abuse.
Sources
- RFC 2474, Definition of the Differentiated Services Field
- RFC 4594, Configuration Guidelines for DiffServ Service Classes
- NIST SP 800-215, Guide to a Secure Enterprise Network Landscape
Last reviewed: 18 October 2026.
