DSCP
Differentiated Services Code Point
A 6-bit field in every IP packet header that classifies the packet into a traffic class, telling routers and switches which queue to use for Quality of Service prioritization.
DSCP is the tagging mechanism behind QoS (Quality of Service). Every IP packet carries a DSCP value in its header. Network devices read that value and route the packet into an appropriate queue — urgent traffic like VoIP gets a low-latency queue, while bulk file transfers wait in a best-effort queue. DSCP itself is just a label; QoS policy on each device determines what the label actually means.
Where DSCP Lives in the IP Header
DSCP occupies the first 6 bits of the 8-bit Differentiated Services (DS) field in IPv4 and IPv6 headers — the same byte position that was historically called the ToS (Type of Service) field in IPv4. The remaining 2 bits are used by ECN (Explicit Congestion Notification), which allows routers to signal congestion without dropping packets. Because DSCP reuses the ToS byte position, older systems and newer systems can coexist without breaking existing header parsers.
With 6 bits, DSCP can express 64 possible values (0–63). Only a subset of these are standardized by IANA and the IETF. The rest are either reserved or available for local policy.
DSCP Code Points and Per-Hop Behaviors
| Code Point | DSCP Value | Per-Hop Behavior | Typical Use |
|---|---|---|---|
| EF | 46 (0x2E) | Expedited Forwarding — low latency, low loss, low jitter | VoIP RTP, real-time audio |
| CS7 | 56 | Network control | Routing protocols (BGP, OSPF) |
| CS6 | 48 | Internetwork control | Reserved for network management |
| AF41 | 34 | Assured Forwarding class 4 — medium drop precedence | Video conferencing |
| AF31 | 26 | Assured Forwarding class 3 | Business-critical interactive apps |
| AF21 | 18 | Assured Forwarding class 2 | Transactional data |
| AF11 | 10 | Assured Forwarding class 1 — lowest AF drop priority | High-throughput data |
| CS3 | 24 | Class Selector 3 | VoIP signaling (SIP) |
| CS1 / LE | 8 / 1 | Low priority / Lower Effort | Bulk transfers, background backups |
| BE (default) | 0 | Best Effort | Standard internet traffic |
The Assured Forwarding (AF) classes each have three drop precedence levels (low, medium, high). Under congestion, a router preferentially drops packets with higher drop precedence within the same AF class first. For example, AF13 packets are dropped before AF11 packets when the AF1 queue is under pressure.
How DSCP Fits Into QoS
QoS on a router involves three steps: classify (identify what the traffic is), mark (set the DSCP value), and act (apply queuing, shaping, or policing based on the mark). DSCP handles the marking step.
Traffic can be marked at multiple points:
- By the application — Windows, macOS, and some apps set DSCP values on their sockets (e.g., Teams and Zoom mark their RTP audio with EF/46).
- By the edge device — An enterprise firewall or router reclassifies and re-marks traffic at network ingress, overriding whatever applications set.
- By the ISP — ISPs commonly zero out DSCP values at their edge (resetting everything to BE/0), so markings rarely survive past your router onto the public internet.
DSCP Trust and Remarking
Whether a device honors incoming DSCP marks or ignores them is a matter of policy called trust. In a managed enterprise network, edge switches are configured to trust DSCP marks from IP phones and video endpoints but distrust marks from user PCs. Untrusted traffic is reclassified based on port numbers or ACLs. This prevents users from marking their BitTorrent traffic as EF to gain priority.
At home, most consumer routers either ignore DSCP entirely and apply their own classification, or pass marks through unchanged. Unless your router explicitly supports DSCP-based queuing, application-level marking has no effect on your LAN.
DSCP and 802.1p / CoS Mapping
DSCP is a Layer 3 (IP) marking. On switched Ethernet LANs, Layer 2 QoS uses the 3-bit Class of Service (CoS) field in the 802.1Q VLAN tag — sometimes called 802.1p or PCP (Priority Code Point). Network devices performing QoS on both Layer 2 and Layer 3 must map between DSCP values and CoS bits. A common mapping puts EF (46) at CoS 5, video AF classes at CoS 4, and voice signaling at CoS 3.
Viewing DSCP Markings
In Wireshark, the DSCP value is shown in the "Differentiated Services" field of any IP packet. Set a display filter like ip.dsfield.dscp == 46 to isolate EF-marked VoIP packets. On Linux, tc qdisc show and tc class show display queue configurations that act on DSCP. On Windows, the Group Policy QoS Packet Marking tool controls per-application DSCP values.
Frequently Asked Questions
How does DSCP relate to QoS?
DSCP is the marking mechanism; QoS is the system that acts on those markings. A router reads the DSCP value in each packet header and queues it accordingly — high-priority VoIP (EF/46) gets a dedicated low-latency queue, bulk downloads wait in a best-effort queue.
What is the difference between DSCP and ToS?
DSCP replaced the older Type of Service (ToS) byte in IPv4. They share the same header field — the first 6 bits are now the DSCP code point, and the last 2 bits are ECN. DSCP defines more granular, standardized traffic classes than the original 3-bit IP Precedence values that ToS used.
Does DSCP work on home networks?
Within your home LAN, DSCP markings are honored if your router's QoS engine is configured to use them. Most consumer routers classify traffic themselves using port numbers or DPI rather than trusting application-set DSCP. ISPs almost always reset DSCP to 0 at their edge, so markings do not survive onto the public internet.