QoS Mechanisms: Classification to Shaping

1. Why Do We Need QoS?

You might think that with today's high-speed gigabit and 10-gigabit links, congestion is a thing of the past. However, QoS is more relevant than ever. Congestion isn't just about slow links; it's about speed mismatches and aggregation points.

To understand this better, let's start with a foundational overview of QoS.

As the video explains, QoS isn't for networks that are congested 24/7—that's a sign you need more bandwidth. Instead, QoS is a powerful toolkit for managing the periods of temporary congestion that are inevitable in any complex network.

The QoS toolkit can be broken down into several categories of tools, which we will explore in this lesson:

• Classification and Marking: Identifying traffic and labeling it for special treatment.
• Congestion Management (Queuing): Managing how packets are sent when an interface is busy.
• Congestion Avoidance: Proactively preventing queues from overflowing.
• Traffic Conditioning (Policing and Shaping): Enforcing rate limits on traffic.

2. Classification and Marking: Identifying and Labeling Traffic

Before we can give special treatment to any traffic, we must first identify it (classification) and then apply a label to it (marking). This is the foundation of any QoS policy. A router or switch can classify traffic based on many criteria, such as source/destination IP addresses, protocol, or port numbers, often using access-control lists (ACLs) or Network Based Application Recognition (NBAR).

Once classified, the packet is marked. This marking allows downstream devices to provide the appropriate QoS treatment without having to re-classify the packet. This principle is often referred to as "classify and mark as close to the source as possible."

Layer 2 vs. Layer 3 Marking

• Class of Service (CoS): A Layer 2 marking that uses 3 bits in the 802.1Q trunking header. This gives 8 possible values (0-7). It's useful within a switched domain but is lost when a packet is routed across a Layer 3 boundary.
• IP Precedence (IPP): A legacy Layer 3 marking that uses the first 3 bits of the Type of Service (ToS) field in the IPv4 header. Like CoS, it offers 8 values (0-7).
• Differentiated Services Code Point (DSCP): The modern and most common Layer 3 marking method. It uses the first 6 bits of the ToS field (now called the DS field), providing 64 possible values (0-63). This granularity is what makes modern QoS so powerful.

A Deep Dive into DSCP

Understanding DSCP is critical for the ENCOR exam. The 64 DSCP values are not just arbitrary numbers; they are associated with specific forwarding treatments, known as Per-Hop Behaviors (PHBs). This creates a standardized way for routers to handle packets.

The following video provides an in-depth analysis of CoS, IPP, and DSCP, complete with the binary math and standard PHB values you need to know.

A key concept related to marking is the trust boundary. As a network professional, you decide where in your network you trust the markings on incoming packets. For example, you would typically trust the DSCP EF marking from your own IP phones, but you would not trust any markings coming from the public internet. At the trust boundary, you can re-mark traffic to fit your internal QoS policy.

3. Congestion Management: Queuing

Marking a packet as high priority is meaningless unless a network device acts on that mark. Queuing is the primary mechanism for doing so. When an interface tries to send more traffic than it has capacity for, the excess traffic is placed in a queue.

The default queuing method is First-In, First-Out (FIFO), where all packets are treated equally. This is essentially the absence of QoS. To provide preferential treatment, we use more advanced queuing algorithms. For your CCNP studies, you need to know two main types:

• Class-Based Weighted Fair Queuing (CBWFQ): This method allows you to create multiple queues for different classes of traffic and guarantee a minimum amount of bandwidth for each class during times of congestion. It's "fair" because it ensures no single class is completely starved of bandwidth. However, it doesn't provide the strict, immediate priority needed for real-time traffic like voice.

• Low Latency Queuing (LLQ): LLQ enhances CBWFQ by adding a strict priority queue. Traffic placed in the priority queue (e.g., voice packets marked with EF) is always served first, before any of the CBWFQ classes. To prevent this priority traffic from starving all other applications, the priority queue is policed, meaning it has a maximum bandwidth limit.

4. Congestion Avoidance: WRED

When a queue becomes completely full, any new packets are dropped. This is called tail drop. If many TCP sessions have packets dropped at the same time, they will all reduce their window size simultaneously, and then ramp back up together, causing waves of congestion and underutilization. This phenomenon is known as TCP Global Synchronization.

To avoid this, we use a congestion avoidance tool called Weighted Random Early Detection (WRED). WRED monitors the depth of a queue and starts to randomly drop a small number of packets before the queue is full. This signals a few TCP sessions to slow down, preventing the massive slowdown associated with tail drop.

This is where the drop probability in Assured Forwarding (AFxy) becomes important. WRED uses the DSCP value to make more intelligent dropping decisions. A packet with a higher drop probability (e.g., AF23) will be dropped sooner and more aggressively than a packet with a lower drop probability (e.g., AF21).

5. Traffic Conditioning: Policing and Shaping

While queuing manages traffic during congestion, policing and shaping are used to enforce a specific rate limit.

• Policing: Enforces a rate limit by dropping (or re-marking) any traffic that exceeds the configured rate. It's often described as abrupt or unforgiving. Policing is commonly used by service providers to enforce a customer's contracted bandwidth.

• Shaping: Enforces a rate limit by buffering (delaying) excess traffic in a queue and sending it later. This smooths out traffic bursts and avoids the packet loss of policing, but it introduces delay and jitter. Shaping is often used by an enterprise on its edge router to ensure its traffic conforms to the provider's policed rate.

The difference is best understood visually.

To understand how policing and shaping work under the hood, let's briefly review the "token bucket" model.

Conclusion

In this lesson, we have deconstructed the essential Quality of Service mechanisms you need to analyze for the ENCOR exam. We've moved from a simple "best-effort" model to a sophisticated toolkit for managing network performance.

Key Takeaways:

• QoS is a toolkit for providing "managed unfairness" during periods of network congestion.
• Classification & Marking are the foundation. DSCP is the modern standard, with key PHBs like EF (for voice), AF (for data classes), and CS (for compatibility).
• Queuing manages congestion. CBWFQ provides minimum bandwidth guarantees, while LLQ adds a strict-priority queue for real-time traffic.
• WRED is a congestion avoidance technique that works with DSCP AF drop probabilities to proactively drop packets and prevent TCP global synchronization.
• Policing and Shaping are traffic conditioners that enforce rate limits. Policing drops excess traffic, while Shaping delays it.

Preview of the Next Lesson:

You now have the analytical framework to understand what each QoS tool does. In our next lesson, "Design and implement a QoS policy for voice, video, and data traffic," we will move from analysis to synthesis. You will learn how to combine these mechanisms using the Modular QoS CLI (MQC) to build a cohesive, end-to-end QoS policy that meets the needs of a real-world enterprise network.