First, the essential ideas
- QoS and PHB
- Quality of Service controls how traffic is classified and treated when sharing network resources. A per-hop behavior is the treatment at one forwarding device, not a guaranteed end-to-end result.
- Delay, jitter and loss
- Delay is elapsed delivery time. Jitter is variation in delay. Loss means packets did not arrive. A slow transfer and broken real-time audio can respond differently to the same congestion.
- Classification and marking
- Classification decides which traffic class a packet belongs to. Marking writes a label into a packet. A label has an effect only where later policy interprets it.
- DSCP
- Differentiated Services Code Point is a six-bit IP field used for traffic treatment. AF11 is a codepoint with decimal value 10; EF has value 46. These values are not bandwidth quantities.
- Queue and scheduler
- A queue temporarily holds packets waiting for transmission. A scheduler chooses which queued packet or class receives service next. A finite queue can overflow.
- Congestion
- Congestion occurs when offered traffic exceeds the service capacity over a relevant interval. Buffers can absorb some bursts but cannot supply unlimited long-term bandwidth.
- Policing and shaping
- A policer meters traffic and applies actions such as dropping or remarking excess. A shaper delays traffic in a queue to meet a profile; its finite queue can still overflow.
- MQC and Console
- Cisco Modular QoS CLI uses class maps for matching, policy maps for actions and service-policy for attachment. Open the named GNS3 Console; IOS # is privileged EXEC and (config)# is configuration.
First distinguish deciding a class from deciding how that class is served. The practical part marks a small ping flow so its classification is visible. The rate and queue examples are separate paper models, not claims about emulator throughput or a real voice call.
See the idea
Excess traffic: act now or delay it
A policer applies an excess action; a shaper can queue for later. Neither creates capacity.
Meter the traffic
Both controls compare traffic with a configured profile. Rate and burst parameters matter; a nominal rate is not the complete policy.
What this model leaves out: Conceptual comparison, not a measured load test. Exact outcomes depend on configured rates, bursts, actions and available queue space.
Full visual explanation and references
A comparison shows a policer dropping or remarking excess traffic and a shaper delaying excess in a finite queue.
Conceptual comparison, not a measured load test. Exact outcomes depend on configured rates, bursts, actions and available queue space.
- Meter the traffic
Both controls compare traffic with a configured profile. Rate and burst parameters matter; a nominal rate is not the complete policy.
www.cisco.com - Choose the excess action
A policer applies its configured action, such as dropping or remarking excess. It does not provide the shaper's waiting queue.
www.cisco.comwww.rfc-editor.org - Account for waiting
A shaper delays packets to fit the profile. Waiting adds delay, and a finite queue can overflow during sustained excess load.
www.cisco.comwww.rfc-editor.org
One idea at a time
Start with something familiar.
Read the word before the action: classify means identify, mark means label, queue means wait and schedule means select service. Keeping those verbs separate makes a policy understandable before learning its command syntax.
Why learn this?
Marking every packet high priority does not increase link speed. It can erase useful distinctions or compete with traffic that genuinely needs bounded delay. Good QoS starts with an application requirement and a known bottleneck.
An everyday comparison
A service desk can label customers by appointment type and decide which waiting line to serve next. A label alone does not add staff or make the line disappear.
What happens in a network
The labels resemble traffic markings, the waiting lines resemble queues and the selection rule resembles scheduling. Their roles differ even when they are configured together.
Where the comparison stopsPackets are served by precise forwarding mechanisms. The analogy does not predict rate limits, packet loss, fairness, latency or what another network will do with a label.
Follow one worked example
- Identify the traffic before choosing its label.
The lab class matches ICMP from PC1 10.42.1.10 to PC2 10.42.2.10. It does not label all traffic or pretend ping is voice.
Why: A narrow match makes the demonstration attributable to one known flow.
- Observe a packet field after marking.
The router sets AF11 on matching requests. A capture on the output cable can show DSCP 10 while replies remain a separate direction.
Why: The packet field is stronger evidence of marking than an unsupported claim that the network became faster.
- Calculate the queue problem separately.
A 1500-byte packet contains 12000 bits. On a modeled 1 Mb/s link its serialization takes 12 milliseconds before overhead.
Why: This arithmetic explains why waiting packets add delay without requiring a misleading emulator speed measurement.
- Compare rate controls by their excess action.
A policer can discard excess; a shaper can queue it for later. Both need a traffic profile and still face finite resources.
Why: Dropping and delaying solve different constraints and affect application behavior differently.
Your first small task
On paper, calculate how long ten 1500-byte packets take to serialize on a 1,000,000-bit/s output. Ignore framing overhead and assume they transmit consecutively. Then state what adding a DSCP label changes about that arithmetic.
Show a hint
Multiply bytes by eight, multiply by packet count, then divide by bits per second.
Check the expected result
Ten packets contain 120,000 bits and take 0.12 seconds, or 120 milliseconds. Marking alone does not change the physical output rate.
Pause and explain it in your own words
An AF11 marking counter rises while ping delay is unchanged. Did the marking fail?
Show a hint
The configured action changes a field; no congestion or queue-service policy was configured.
Show the explanation
Not necessarily. Inspect the captured DSCP field to verify marking. Lower delay was never the promised action, and an uncongested ping cannot establish scheduling or application-quality benefits.
Short answer
What should you understand today?
QoS decides how traffic shares constrained resources. Classification identifies a class; marking labels packets; scheduling serves queues; policing can drop or remark excess; shaping delays packets to meet a profile. None creates extra physical capacity. A marking counter or DSCP value does not prove reduced delay, low jitter or an end-to-end service guarantee.
Before you begin
Learning targets
- Recall Day 7 ICMP versus TCP/UDP and Day 31 routing between two /24 subnets.
- Use GNS3 2.2.55, one entitled C8000v IOS XE 17.12.1a router, two VPCS 0.8 nodes and Wireshark 4.x.
- Know that one byte has eight bits; the paper calculation uses decimal megabits per second and excludes link overhead.
- Distinguish classification, marking, queuing, congestion, policing and shaping.
- Interpret delay, jitter and loss without claiming a single ping measures application quality.
- Calculate transmission time and explain why finite buffers cannot fix sustained overload.
- Attach and inspect a simple input marking policy on the intended interface.
- Remove and restore the attachment, then compare the same flow and packet field.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
QoS and PHB
Quality of Service controls how traffic is classified and treated when sharing network resources. A per-hop behavior is the treatment at one forwarding device, not a guaranteed end-to-end result.
Delay, jitter and loss
Delay is elapsed delivery time. Jitter is variation in delay. Loss means packets did not arrive. A slow transfer and broken real-time audio can respond differently to the same congestion.
Classification and marking
Classification decides which traffic class a packet belongs to. Marking writes a label into a packet. A label has an effect only where later policy interprets it.
DSCP
Differentiated Services Code Point is a six-bit IP field used for traffic treatment. AF11 is a codepoint with decimal value 10; EF has value 46. These values are not bandwidth quantities.
Queue and scheduler
A queue temporarily holds packets waiting for transmission. A scheduler chooses which queued packet or class receives service next. A finite queue can overflow.
Congestion
Congestion occurs when offered traffic exceeds the service capacity over a relevant interval. Buffers can absorb some bursts but cannot supply unlimited long-term bandwidth.
Policing and shaping
A policer meters traffic and applies actions such as dropping or remarking excess. A shaper delays traffic in a queue to meet a profile; its finite queue can still overflow.
MQC and Console
Cisco Modular QoS CLI uses class maps for matching, policy maps for actions and service-policy for attachment. Open the named GNS3 Console; IOS # is privileged EXEC and (config)# is configuration.
QoS starts with an application need and a bottleneck
A bulk download mainly values throughput, while interactive voice is sensitive to delay, jitter and loss. These are different requirements, not a reason to call every important application highest priority. Locate the constrained output and understand its offered traffic. A fast internal link feeding a slower service can still create congestion even when the physical port reports a high speed.
- Distinguish service capacity from a port's nominal speed.
- A finite buffer absorbs some bursts, not permanent overload.
Classification identifies and marking labels
Classification groups packets by criteria such as addresses, protocol or a trusted marking. Marking writes a field such as DSCP. A trust boundary decides whether arriving labels are accepted or replaced; it should not blindly accept arbitrary endpoint claims. A class map defines matching; a policy map defines the action; attaching the policy makes it active on a direction.
- Defining a policy without attaching it does not process interface traffic.
- A marking can be changed or ignored by a later network.
Queues and scheduling determine who waits
A queue stores traffic awaiting service and has finite capacity. Scheduling determines which class or packet is transmitted next. Priority service can reduce waiting for selected traffic under a suitable design, but uncontrolled priority traffic can harm other classes. Congestion management is not identical to avoiding congestion; active queue management can signal congestion or drop selected packets before a queue fills completely.
- A larger queue can reduce immediate drops while increasing waiting time.
- A single ping sample does not characterize jitter or loss under load.
Policing meters and acts on excess
A policer compares traffic with a configured profile, often using a token-bucket model that allows defined bursts. Depending on policy, conforming traffic is sent while excess can be dropped or remarked. A policer does not generally hold excess in a shaping queue for later delivery. Drops may trigger transport retransmissions or degrade real-time media, depending on the application.
- Rate units and burst parameters are part of the policy, not optional context.
- A policer can enforce a boundary without smoothing every burst.
Shaping delays traffic to fit a profile
A shaper meters and queues traffic so departure better fits a configured profile. It can smooth bursts and reduce drops at a downstream rate limit, but it adds waiting and has finite storage. Sustained offered load above the shaped rate eventually exhausts the queue or requires other congestion response. Shaping is commonly an output function; support and hierarchy vary by platform.
- Shaping may trade lower downstream loss for higher local delay.
- A configured rate and an empty queue are not evidence of performance under congestion.
Verify the action you actually configured
For the marking exercise, compare the input attachment, class counters and the packet's DSCP after the router. For a real queue policy, additional offered-load, output-rate, drop, delay and application evidence would be necessary. Direction matters: marking the request does not imply the return packet was marked by the same input policy.
- A successful ping and a correct DSCP value answer different questions.
- Current v1.1 runs through 2 February 2027; announced v2.0 starts 3 February 2027.
Real-world walkthrough
A priority label is present, but audio still breaks
In a fictional branch, an engineer sees a priority label in a capture and concludes voice quality must be protected. The constrained output has no verified queue policy, and a downstream provider may remark traffic. The useful investigation separates the marking decision from each hop's actual treatment and the application's measured experience.
- Identify the application flow, direction, offered rate and actual bottleneck before changing markings.
- Check where classification and marking occur and whether endpoint labels are trusted at an appropriate boundary.
- Inspect the output scheduling, rate limits and drop evidence rather than assuming a label guarantees priority.
- Compare measured delay, jitter and loss under a controlled representative load, with authorization and a rollback plan.
- Document which hop and treatment were verified. Do not generalize one capture into an end-to-end service guarantee.
Guided GNS3 lab
Observe a marking policy without claiming a congestion benchmark
Configure an exact ICMP classifier and AF11 marker, inspect counters and a packet field, detach and restore the policy. Queuing and rate-control comparisons are paper exercises; no runtime or performance measurements were taken during authoring.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| PC1 | Ethernet0 | 10.42.1.10/24; gateway 10.42.1.1 | Source of the selected ICMP requests. |
| QoS1 | GigabitEthernet1 | 10.42.1.1/24 | Input marking attachment. |
| QoS1 | GigabitEthernet2 | 10.42.2.1/24 | Output capture toward PC2. |
| PC2 | Ethernet0 | 10.42.2.10/24; gateway 10.42.2.1 | Final destination and reply origin. |
Set up the lab
- Create fresh nodes and the two listed links. Keep QoS1 Console open and record its software version and interface map.
- Install Wireshark before isolation. In GNS3, right-click only the QoS1-to-PC2 link and choose Start capture; select that link's Ethernet capture, not a host adapter.
- No real voice call or high-rate traffic is generated. Do not use a public or employer network to manufacture congestion.
- Without an entitled router or capture support, use the labeled paper model and record marking/queue/runtime evidence as unmeasured.
Address the routed lab path
In GNS3, right-click QoS1 and choose Console before typing. Start at > or # on a fresh device. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
configure terminal
interface GigabitEthernet1
ip address 10.42.1.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet2
ip address 10.42.2.1 255.255.255.0
no shutdown
end
show ip interface briefWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
interface GigabitEthernet1- Select the cable toward PC1.
ip address 10.42.1.1 255.255.255.0- Assign the source subnet gateway.
no shutdown- Enable the source-facing interface.
exit- Return to global configuration.
interface GigabitEthernet2- Select the cable toward PC2.
ip address 10.42.2.1 255.255.255.0- Assign the destination subnet gateway.
no shutdown- Enable the destination-facing interface.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show ip interface brief- Verify both planned addresses and operational state.
- What you should see
- Both connected subnets should be available without additional static routes.
- Why this step matters
- A known working routed path is needed before attributing changes to QoS.
Configure the source host
In GNS3, right-click PC1 and choose Console before typing. Use the VPCS prompt and set the exact planned source. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ip 10.42.1.10/24 10.42.1.1
show ipWhat each command means
ip 10.42.1.10/24 10.42.1.1- Assign PC1's address, /24 mask and local gateway.
show ip- Confirm the source address used by the classifier.
- What you should see
- PC1 reports the intended source and gateway.
- Why this step matters
- A different source would miss the exact classifier even if routing still worked.
Configure the recipient
In GNS3, right-click PC2 and choose Console before typing. Use this node's VPCS prompt, not PC1's window. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ip 10.42.2.10/24 10.42.2.1
show ipWhat each command means
ip 10.42.2.10/24 10.42.2.1- Assign the final destination and its return gateway.
show ip- Verify the destination settings and return-path gateway.
- What you should see
- PC2 reports the distinct destination subnet.
- Why this step matters
- A correct return gateway is necessary for replies but does not configure any QoS treatment.
Record the unmarked baseline
In GNS3, right-click PC1 and choose Console before typing. Start the specified output-link capture in GNS3, then use the VPCS prompt. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 10.42.2.10What each command means
ping 10.42.2.10- Generate the same request flow used throughout the exercise.
- What you should see
- Replies should arrive. In Wireshark filter ip.src == 10.42.1.10 && icmp, expand IPv4 and record the actual DSCP field.
- Why this step matters
- The baseline must be observed; do not assume an inherited or endpoint marking is zero without inspection.
Define the exact classifier
In GNS3, right-click QoS1 and choose Console before typing. Start at #. This ACL classifies traffic for QoS and is not attached as an interface filter. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip access-list extended PING
permit icmp host 10.42.1.10 host 10.42.2.10
exit
class-map match-all LAB_PING
match access-group name PING
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip access-list extended PING- Create the dedicated named extended classifier list.
permit icmp host 10.42.1.10 host 10.42.2.10- Match only ICMP from the exact source to the exact recipient.
exit- Leave ACL mode for global configuration.
class-map match-all LAB_PING- Create a class requiring its configured matching criteria.
match access-group name PING- Use the PING ACL as this class's match criterion.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- The class names and addresses match the recorded flow.
- Why this step matters
- A narrow classifier avoids marking unrelated traffic as part of the demonstration.
Define and attach the marker
In GNS3, right-click QoS1 and choose Console before typing. Start at # and attach the policy to traffic entering from PC1. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
policy-map MARK
class LAB_PING
set dscp af11
exit
exit
interface GigabitEthernet1
service-policy input MARK
end
show policy-map interface GigabitEthernet1What each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
policy-map MARK- Create the traffic policy named MARK.
class LAB_PING- Select the previously defined traffic class within the policy.
set dscp af11- Write AF11, decimal DSCP 10, on matching IP packets.
exit- Return to policy-map configuration.
exit- Return to global configuration before selecting the interface.
interface GigabitEthernet1- Select the source-facing interface.
service-policy input MARK- Apply MARK to traffic entering from PC1.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show policy-map interface GigabitEthernet1- Inspect attachment direction, class matches and action counters.
- What you should see
- The input attachment should be present; traffic is still needed to observe matches.
- Why this step matters
- A policy definition alone cannot mark packets until attached at the intended point.
Generate marked requests
In GNS3, right-click PC1 and choose Console before typing. Use the VPCS prompt while the output-link capture is running. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 10.42.2.10What each command means
ping 10.42.2.10- Send the original selected flow again for a controlled comparison.
- What you should see
- Matching requests should show DSCP 10 after QoS1. Replies are a separate direction and are not promised the same label.
- Why this step matters
- In QoS1's Console at # repeat show policy-map interface GigabitEthernet1; compare counters with packet evidence rather than claiming lower delay.
Detach only the input policy
In GNS3, right-click QoS1 and choose Console before typing. Start at # after recording marked requests. Leave addresses, ACL and policy definitions unchanged. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
interface GigabitEthernet1
no service-policy input MARK
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
interface GigabitEthernet1- Select the original input attachment point.
no service-policy input MARK- Remove only the active input attachment, not the routing path.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- The MARK input attachment should be absent while ordinary forwarding remains available.
- Why this step matters
- The safe fault separates an inactive policy from a broken IP path.
Compare the detached flow
In GNS3, right-click PC1 and choose Console before typing. Use the VPCS prompt with the same capture and filter. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping 10.42.2.10What each command means
ping 10.42.2.10- Retest the original destination while the marker is detached.
- What you should see
- Replies should continue. The output DSCP should return to the observed unmarked baseline for new requests.
- Why this step matters
- This is not a service outage test; the intended fault is loss of the configured labeling action.
Restore the attachment
In GNS3, right-click QoS1 and choose Console before typing. Start at # and restore the original input direction. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
interface GigabitEthernet1
service-policy input MARK
end
show policy-map interface GigabitEthernet1What each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
interface GigabitEthernet1- Select the same PC1-facing interface.
service-policy input MARK- Restore the exact marker attachment.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show policy-map interface GigabitEthernet1- Verify the restored direction and inspect new matches after a repeat PC1 ping.
- What you should see
- Repeat PC1's original ping and verify matching requests again carry DSCP 10.
- Why this step matters
- Rollback needs packet and policy evidence, not only successful command parsing.
Compare rate controls on paper and close
On paper, use the one-second 2 Mb/s arrival versus 1 Mb/s service example. Label the 125000-byte excess as delayed by a shaper or subject to a configured policer action. State finite queue and burst assumptions. Stop the GNS3 capture and all nodes.
- What you should see
- The arithmetic distinguishes delayed and discarded excess but does not measure this router's queues, policing, shaping or voice quality.
- Why this step matters
- Keeping the model separate prevents an illustrative calculation from becoming a fabricated performance result.
Verify
- Confirm the exact ICMP classifier and input MARK attachment on GigabitEthernet1.
- Record the actual baseline DSCP, attached AF11/10, detached baseline and restored AF11/10 in new request packets.
- Compare class counters with packet fields and distinguish request from reply direction.
- Label queue arithmetic, policing, shaping, EF behavior and application-quality claims as conceptual rather than runtime measurements.
Troubleshoot
- No match counter growth: verify the actual source/destination, ICMP protocol and input attachment; do not broaden the ACL to any as a shortcut.
- Counter grows but capture looks unchanged: verify the output capture cable, packet direction and ip.dsfield.dscp field; a capture before marking answers a different question.
- Policy rejected: record platform and release restrictions and use the paper alternative rather than inventing a queue command.
- Ping delay unchanged: that is not a failed marking test. No output scheduling, congestion load or application-quality experiment was configured.
GNS3 does not provide Cisco software images. Use Cisco images only when the applicable license or entitlement permits this environment. Do not share or redistribute image files. Cisco Modeling Labs is an official alternative; its supplied reference images are licensed for CML, not automatically for export to GNS3. Use the labeled paper alternative when authorized software is unavailable. No emulator execution is claimed by this lesson.
- Detach MARK after final verification or revert the disposable router snapshot before reuse.
- Stop the link capture and keep packet files private; do not use this teaching AF11 classification as a production QoS template.
Practice set
Answer before you reveal
01How do classification and marking differ?
A class can be identified without rewriting a packet. A label only affects later treatment where a device's policy interprets it.
02How long is 1500 bytes at 1 Mb/s without overhead?
There are 12000 bits in 1500 bytes. Dividing by 1000000 bits per second gives 0.012 seconds, excluding queue wait and link overhead.
03What distinguishes shaping from policing?
Both meter traffic against a profile. A shaper still has finite storage, and a policer need not use the same action for every traffic condition.
04Why does marking not guarantee lower delay?
Delay depends on forwarding, queues, load and all relevant hops. The lab deliberately configures no congestion benchmark.
05Why inspect only PC1-originated requests in the capture?
The reply enters the other interface and is not processed by that same input attachment. Direction is part of the policy's scope.
06What can happen when a shaping queue fills?
Shaping changes departure timing; it does not provide infinite memory or eliminate the consequences of sustained overload.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Classification, marking and scheduling are distinct decisions.
- QoS does not create physical link capacity.
- Policing and shaping differ in how excess is handled.
- Marking verification needs the correct capture point and direction.
- Keep conceptual queue models separate from runtime performance evidence.