Computer Network
📂 Transport Layer
· 4 of 4
48 min read
Quality of Service
Master Quality of Service — from best-effort vs DiffServ/IntServ models to DSCP field encoding, LLQ priority queuing, Token Bucket shaping and policing, and real-time QoS metrics. Features an interactive DSCP class diagram, live priority queue scheduler simulation, switchable Token Bucket policing/shaping animation, and ITU threshold charts. Includes COVID network congestion and NHS hospital QoS cases.
Section 01
Quality of Service — When "Best Effort" Is Not Good Enough
📖 Real World Analogy
An Airport with Economy, Business, and First Class
Imagine an airport security queue. Everyone needs to pass through the same
physical checkpoint, but not everyone waits equally. Business class passengers
use a dedicated fast lane. VIP passengers bypass the queue entirely. Economy
passengers wait, but the process is still fair — first come, first served.
The airport does not add more security officers — the same staff process the
same number of people. What changes is the priority given to different
travellers based on their ticket class.
Quality of Service (QoS) works identically in networking. The
same physical network links carry all traffic. QoS decides who gets served first,
how much bandwidth each type of traffic receives, and how long each packet waits
in the queue — without adding a single extra cable or router.
The Internet was designed as a best-effort network — every packet
is treated identically, delivered "as well as possible," with no promises about
delay, jitter, or loss. For email and file downloads this is perfectly acceptable.
But for a surgeon performing a remote operation over a 5G link, a financial
trading system where microseconds mean millions, or a Zoom call where 150ms delay
makes conversation impossible — best-effort fails catastrophically.
QoS is the set of mechanisms that allow network devices — routers,
switches, and firewalls — to differentiate traffic and provide measurable,
guaranteed performance characteristics to specific flows, even under congestion.
📌
The Three QoS Guarantees — What Can Be Controlled
Bandwidth — the minimum (or maximum) data rate allocated to a
traffic class. "Video conferencing gets at least 4 Mbps even under load."
Latency (Delay) — the maximum time a packet spends in queue
before being forwarded. Voice packets must be forwarded within 5ms. File backups
can wait 500ms.
Jitter — variation in delay between consecutive packets. Voice
codecs can tolerate up to 30ms of jitter before the audio becomes robotic.
QoS uses traffic shaping and jitter buffers to smooth this.
Packet Loss — the percentage of packets dropped. VoIP starts
degrading at 1% loss. Video calls tolerate up to 5%. File transfers need 0%.
📶 Core QoS Vocabulary
Classification
Identifying what type of traffic a packet belongs to — by IP, port, DSCP mark, application signature, or deep packet inspection (DPI).
Marking
Tagging packets with a priority value — DSCP in the IP header (Layer 3) or 802.1p CoS in the Ethernet frame (Layer 2). Marks travel with the packet across the network.
Policing
Enforcing a traffic rate by dropping packets that exceed a defined limit. Hard enforcement — excess traffic is discarded immediately. No buffering.
Shaping
Smoothing traffic to a target rate by delaying (buffering) excess packets rather than dropping them. Adds latency but prevents loss. Used at network egress.
Queuing
Organising packets into priority queues so high-priority traffic is forwarded first. The scheduler decides the order in which packets leave the router interface.
Congestion Management
What happens when a queue is full — which packets are dropped, and using which algorithm (tail-drop, WRED, CoDel). Determines whose traffic suffers under load.
Section 02
QoS Models — IntServ, DiffServ, and Best Effort
🚫
Best Effort
No QoS — RFC 1122 baseline
All packets treated identically. First-in, first-out (FIFO). No bandwidth guarantees, no priority, no delay bounds. Works well at low utilisation. Fails under congestion — all flows suffer equally. The Internet default.
✗ No guarantees ✗ Unfair under load
🌐
IntServ
Integrated Services — RFC 1633
Each flow reserves resources end-to-end using RSVP (Resource Reservation Protocol). The network guarantees specific bandwidth and delay per flow. Extremely precise but unscalable — every router must store state for every flow. Used only in specialised networks (military, research).
✗ Doesn't scale to Internet ✗ Complex RSVP signalling
✅
DiffServ
Differentiated Services — RFC 2474
Packets are marked with a DSCP value. Routers handle packets according to their class — no per-flow state. Scalable to any network size. The dominant QoS model for enterprise and ISP networks worldwide. Defines Assured Forwarding (AF) and Expedited Forwarding (EF) classes.
✓ Scales to Internet ✓ Simple per-hop behaviour
DiffServ — DSCP Field in the IP Header
DiffServ repurposes the 8-bit Type of Service (ToS) byte in
IPv4 / Traffic Class byte in IPv6. The top 6 bits form the
DSCP (Differentiated Services Code Point). The bottom 2 bits are
used for ECN (Explicit Congestion Notification).
📋 DSCP Field — 6-Bit Priority Encoding in the IP Header
👉 Click any DSCP class in the diagram above
The 6-bit DSCP field encodes 64 possible per-hop behaviours. Click each colour-coded class to see its decimal value, use case, and typical applications.
💡 DSCP marking is done at the edge of the network (your router or switch) and re-marked to zero at peering points between ISPs — most ISPs do not honour each other's DSCP marks. This is why end-to-end QoS across the public Internet is unreliable; it works reliably only within a single organisation's managed network or MPLS VPN.
DSCP Name
Value
PHB
Traffic Type
Typical Apps
EF
46
Lowest delay
Real-time voice
VoIP, interactive audio
AF41/42/43
34/36/38
Video priority
Interactive video
Zoom, Teams, WebEx
AF31/32/33
26/28/30
Streaming
Call signalling / stream
SIP, Netflix adaptive
AF21/22/23
18/20/22
Business data
Transactional apps
ERP, CRM, database
AF11/12/13
10/12/14
Bulk / Scavenger
Low-priority data
Backups, OS updates
CS0 / Default
0
Best effort
General Internet
HTTP, email, social
Section 03
QoS Queuing Mechanisms — Who Gets Served First
When a router's output interface is congested, packets back up in queues.
The queuing algorithm decides which packet leaves the interface next.
This is the heart of QoS — the scheduler that determines delay, jitter, and
fairness for every traffic class.
📈
FIFO — First In, First Out
Tail-drop · No priority
Single queue. Packets leave in arrival order. When full, all new packets are dropped equally (tail-drop). Zero QoS. Simple and fast. Used on low-utilisation links or where QoS is not needed. Everything treats all flows identically — fair but blind to priority.
🚀
PQ — Priority Queuing
Strict priority · Risk of starvation
Multiple queues with strict priority. The highest-priority queue is always served first. Lower queues only get CPU time when all higher queues are empty. Guarantees lowest latency for top-priority traffic (VoIP). Risk: a flood of high-priority traffic starves all lower classes completely.
⚖️
WFQ — Weighted Fair Queuing
Proportional share · No starvation
Each flow or class gets a weighted share of bandwidth. Higher-weight queues get proportionally more throughput. No queue is ever completely starved — lower-weight queues always get some service. The basis for CBWFQ (Class-Based WFQ) used in Cisco enterprise QoS deployments.
⚡
CBWFQ — Class-Based WFQ
RFC 2475 · Enterprise standard
Extends WFQ to user-defined traffic classes. Each class is assigned a minimum bandwidth guarantee. Unused bandwidth from one class is redistributed to others. Cisco's primary QoS mechanism — classes defined by ACLs, DSCP marks, or protocols. Works with LLQ for voice.
🎧
LLQ — Low Latency Queuing
CBWFQ + strict PQ for voice
Adds a strict-priority "express lane" to CBWFQ. Voice (EF-marked) traffic goes into the strict-PQ and is always served first. All other classes still share bandwidth fairly via CBWFQ weights. The Cisco recommended model for networks carrying VoIP. The golden standard for enterprise voice QoS.
📉
WRED — Weighted Random Early Detection
Proactive drop · TCP-friendly
Randomly drops packets before the queue is full, with probability proportional to queue depth and DSCP class. High-priority (EF) traffic has a much lower drop probability. Prevents tail-drop synchronisation — prevents all TCP flows from slowing down simultaneously. Used inside CBWFQ queues.
Section 04
🏭 Animated: Priority Queuing in Action
The animation shows a router handling three traffic classes simultaneously —
VoIP (highest priority), Video (medium), and Data (bulk) — arriving at the same
interface under congestion. Watch how the priority scheduler ensures VoIP packets
leave first, every time.
▶ LLQ Priority Scheduler — VoIP, Video, Data Under Congestion
Click Play to start congestion simulation
💡 Under congestion all three classes try to send simultaneously. VoIP (EF) always exits first — maintaining <5ms queuing delay. Video gets next service. Data waits. This is why voice calls stay crystal clear even when a large file upload saturates the same link.
Section 05
Traffic Shaping vs Policing — Delay or Drop?
When traffic exceeds its allocated rate, the network must respond. There are two
fundamental approaches — and choosing the wrong one causes very different problems.
🚫 Policing — Hard Enforcement (Drop Excess)
Property
Behaviour
Excess packets
Dropped immediately or re-marked
Delay introduced
None — instant drop decision
Bursty traffic
Burst is clipped at the rate limit
TCP response
Packet loss → TCP backs off (good)
Typical use
Customer ingress rate enforcement (ISP)
Where used
Network ingress, SLA enforcement
Your ISP uses policing to enforce your 100 Mbps plan limit. If you download at 120 Mbps, the excess 20 Mbps is dropped — instantly, with no delay. You see this as TCP retransmissions.
🔄 Shaping — Smooth (Buffer & Delay Excess)
Property
Behaviour
Excess packets
Buffered — sent when rate allows
Delay introduced
Yes — proportional to burst size
Bursty traffic
Burst is smoothed to target rate
TCP response
No loss → TCP stays at full rate
Typical use
WAN egress, video upload smoothing
Where used
Customer CPE, WAN edge, CDN upload
Netflix's upload servers shape video streams to the CDN. Instead of bursting and causing congestion, they buffer and send at a smooth rate — maintaining quality without triggering TCP backoff.
🏭 Animated: Token Bucket Algorithm — the Core of Both Shaping and Policing
Both policing and shaping use the Token Bucket algorithm to measure
and control traffic rate. Tokens accumulate at the allowed rate (e.g. 10 Mbps).
Each packet consumes tokens equal to its byte size. If tokens are available, the
packet is forwarded (or buffered for shaping). If not, it is dropped (policing)
or queued (shaping).
▶ Token Bucket — Animated Rate Control Mechanism
Mode: Policing
💡 The bucket depth (Bc) determines the maximum burst size — how many tokens can accumulate when no traffic flows. A deeper bucket allows larger bursts. Tokens accumulate at the CIR (Committed Information Rate) — the contracted average rate.
Section 06
🏭 Animated: QoS Metrics — Latency, Jitter & Loss Under Load
The four QoS metrics — bandwidth, delay, jitter, and loss — behave very differently
as network utilisation increases. The animation below shows how each metric degrades
for VoIP traffic on a link with and without QoS configured.
▶ QoS Metrics — With vs Without QoS as Load Increases
💡 The red dashed thresholds show the ITU G.114 recommended maximums for toll-quality voice: one-way delay <150ms, jitter <30ms, packet loss <1%. Without QoS, all three thresholds are breached at ~60% network utilisation. With QoS, VoIP stays below all thresholds even at 95% utilisation.
Section 07
Layer 2 QoS — 802.1p CoS and MPLS EXP/TC
QoS does not only live in the IP header. Layer 2 technologies have their own
priority marking mechanisms — essential for switches and MPLS backbones where
the IP header may be hidden inside a tunnel.
🏴
802.1p CoS — Class of Service
The 802.1Q VLAN tag header contains a 3-bit Priority Code Point (PCP)
field — also called Class of Service (CoS). Values 0–7:
0=background, 1=best effort, 2=excellent effort, 3=critical data,
4=video, 5=voice, 6=internetwork control, 7=network critical.
CoS marks are used within a switched LAN (campus network). At the router,
CoS is mapped to DSCP for Layer-3 propagation. CoS is invisible across
routed boundaries — it only survives one VLAN segment.
802.1Q | 3-bit PCP | Switches | Campus LAN QoS
🔌
MPLS EXP / TC Bits
MPLS label stacks include a 3-bit Traffic Class (TC) field
(formerly called EXP — experimental). Used by ISP backbones to carry
QoS markings through MPLS tunnels where the IP header is not visible to
P (provider core) routers. Maps 1-to-1 with 802.1p CoS values (both 3 bits = 8 classes).
Cisco MPLS QoS maps DSCP → TC at ingress PE routers and TC → DSCP at egress PE.
At enterprise/ISP boundaries, DSCP marks from untrusted sources are re-marked to
CS0 (default). Enterprises cannot trust markings from the public Internet —
a malicious host could mark all its traffic as EF to steal priority.
The trust boundary is typically the first managed switch port. Within the trusted
domain, marks propagate unmodified. This is why end-to-end Internet QoS doesn't work.
During the March 2020 global lockdown, Internet traffic surged 40–70% overnight.
Netflix, YouTube, and Amazon Prime Video voluntarily reduced European streaming
bitrates by 25% at the request of EU regulators — effectively self-imposing
traffic shaping to prevent network collapse. Comcast reported average broadband
usage up 32%. ISPs across the UK temporarily suspended fair usage policies.
QoS prioritisation of video conferencing (Zoom/Teams) became critical as home
networks had no QoS configured. Source: Sandvine Global Internet Phenomena
Report 2020; BBC News "Netflix to reduce streaming quality in Europe."
Netflix streaming speeds on Comcast fell by 27% over six months in 2013–2014.
Netflix accused Comcast of deliberately degrading traffic (negative QoS) until
Netflix paid peering fees. Comcast denied throttling, citing congested peering
points. Netflix eventually paid, and speeds recovered within weeks. This incident
directly motivated the FCC's 2015 Open Internet Order (net neutrality rules —
later repealed in 2017). Source: The Verge "Netflix streaming speeds on Comcast
drop 27 percent"; FCC Open Internet Report 2015.
Throttling | Net neutrality | Peering congestion | Netflix/Comcast 2014
🏥
Hospital Networks — QoS Saves Lives
Modern hospitals use a single converged IP network for patient monitoring
(telemetry), clinical voice (VoIP), PACS medical imaging (large DICOM files),
electronic health records (EHR), and general staff internet. Without QoS,
a large DICOM image transfer (up to 2 GB) would saturate the link and delay
a critical ECG alarm. NHS trust networks are required to implement LLQ for
clinical voice and strict prioritisation for patient monitoring traffic.
Source: NHS Digital Network Design Guidance 2022; HIMSS Network Infrastructure Guidelines.
Cisco's Modular QoS CLI (MQC) is the industry-standard framework
for configuring QoS on routers and switches. It separates the three concerns of
QoS — classification, policy, and interface attachment — into distinct components.
1
Class Map — Classify Traffic
Defines what traffic belongs to a class using match criteria: DSCP value, ACL (source/dest IP or port), protocol (NBAR application detection), or CoS bits. Example: match traffic to port 5060 (SIP) as "voice-signalling" class.
2
Policy Map — Define Actions Per Class
Associates each class with a QoS action: set DSCP mark, police to rate limit, shape to rate, assign to priority queue, or allocate bandwidth percentage. Chains class maps to their treatments.
3
Service Policy — Attach to Interface
The policy map is applied to a physical or virtual interface in either the input direction (classification and policing at ingress) or output direction (queuing and shaping at egress). One policy per direction per interface.
4
Verification — show policy-map interface
Verify the policy is working: check packet counts per class, bytes matched, drops per class, and WRED statistics. Confirm DSCP marks are being applied with show interfaces … output-drops and Wireshark captures.
MQC POLICY — ENTERPRISE LLQ EXAMPLE (CONCEPTUAL)
CLASS-MAP: VOICE → match dscp ef → priority 512 kbps (strict-PQ)
CLASS-MAP: VIDEO → match dscp af41 → bandwidth percent 30
CLASS-MAP: SIGNALLING → match dscp cs3 → bandwidth percent 5
CLASS-MAP: BUSINESS → match dscp af21 → bandwidth percent 20
CLASS-MAP: BULK → match dscp af11 → bandwidth percent 10
CLASS-MAP: DEFAULT → match any → fair-queue (remaining)
SERVICE-POLICY applied to: GigabitEthernet0/1 OUTPUT
Section 10
Golden Rules — QoS Design & Implementation
📌 Non-Negotiable Rules for Every QoS Engineer
1
Classify and mark traffic as close to the source as possible.
Marking at the access switch (trust boundary) prevents spoofing and ensures
consistent treatment end-to-end. Never trust DSCP marks arriving from untrusted
endpoints (PCs, phones on the Internet) — re-classify at the first managed device.
2
Never put more than 33% of link bandwidth in the strict-priority queue.
EF/LLQ traffic is served before everything else. If VoIP bursts above 33% of the
link capacity, all other classes — including business data and signalling — are
starved. Admission control (call manager limits) must enforce this ceiling.
3
QoS does not add bandwidth — it only prioritises what exists.
If a 10 Mbps link carries 20 Mbps of traffic, QoS decides who suffers — it cannot
make 10 Mbps become 20 Mbps. If every application is marked as highest priority,
QoS achieves nothing. Differentiation requires genuinely different priority levels.
4
Configure QoS end-to-end — every hop in the path must enforce the policy.
A single unconfigured router in the middle treats all traffic as best-effort.
The weakest link determines the actual quality. Map DSCP → CoS at every LAN/WAN
boundary and verify with show policy-map interface counters.
5
Use WRED, not tail-drop, inside CBWFQ queues for TCP traffic.
Tail-drop causes TCP synchronisation — all flows slow down together, then ramp up
together, creating oscillation. WRED's probabilistic drops desynchronise TCP flows
and maintain higher average throughput. Enable WRED on all non-EF queues.
6
Shape outbound traffic to slightly below the physical link rate.
When a link is 100 Mbps but the ISP's policing kicks in at 100 Mbps, shaping to
95 Mbps prevents the ISP's policer from dropping your traffic — at the cost of a
tiny bit of throughput. This avoids asymmetric policing drops on burst traffic.
7
Baseline first — measure before and after QoS deployment.
Use tools like IPERF, Wireshark, NetFlow, and SNMP to measure actual delay,
jitter, and loss per class before and after. QoS misconfiguration can make things
worse — a poorly designed policy can starve critical traffic that was previously
getting adequate best-effort service.
🎓
The Complete Picture
Quality of Service is not about adding bandwidth — it is about
using existing bandwidth intelligently. It is the network's promise that
when the link is congested, the right traffic wins.
Classification and marking create the labels. Queuing
mechanisms (FIFO, PQ, WFQ, LLQ) decide the order of service.
Policing enforces hard rate limits at the edge. Shaping
smooths bursts into the network. WRED prevents queue collapse.
Together, these mechanisms transform a best-effort network into one that can
guarantee a surgeon's telemedicine feed stays at 4K while a file backup
quietly queues in the background — on the very same 10 Mbps WAN link.
From hospital networks to ISP backbones, from Cisco MQC configurations to
RFC 2474 DSCP standards — QoS is the invisible contract between your applications
and the network infrastructure they depend on.