Qos Tagging - What device is doing all the tagging?

[Shaun Michelson]

I've configured our C2960S switches using the "auto qos" command and have the following configuration applied to all of our switchports:

interface GigabitEthernet1/0/47

switchport access vlan 2

switchport mode access

switchport voice vlan 5

srr-queue bandwidth share 10 10 60 20

priority-queue out

mls qos trust dscp

auto qos trust

spanning-tree portfast

Each port has two devices connected, an Avaya IP phone and a computer workstation. The Avaya phone is tagging its traffic with DSCP 46 and COS 6.

When I run the command "show mls qos interface g1/0/47 statistics", my incoming traffic looks as expected - either its untagged (DSCP/CoS 0) or it's tagged DSCP 46 / CoS 6:

dscp: incoming
-------------------------------

  0 -  4 :   106207615            0            0            0            0
  5 -  9 :           0            0            0            0            0
 10 - 14 :           0            0            0            0            0
 15 - 19 :           0            0            0            0            0
 20 - 24 :           0            0            0            0            0
 25 - 29 :           0            0            0            0            0
 30 - 34 :           0            0            0            0            2
 35 - 39 :           0            0            0            0            0
 40 - 44 :           0            0            0            0            0
 45 - 49 :           0     80031794            0            0            0
 50 - 54 :           0            0            0            0            0
 55 - 59 :           0            0            0            0            0
 60 - 64 :           0            0            0            0

 cos: incoming
-------------------------------

  0 -  4 :   103201599            0            0            0            0
  5 -  7 :           0     84804720            0

However, the outgoing traffic is a mixture of just about every DSCP / CoS value under the sun:

dscp: outgoing
-------------------------------

  0 -  4 :      937091          487        24754          696        77133
  5 -  9 :        1038        35806         1719      1014396            0
 10 - 14 :      376862            0        18115           59         9428
 15 - 19 :           0           91            0        16103            0
 20 - 24 :       13083            0         8746            0         6632
 25 - 29 :           0        14846            0         6352            0
 30 - 34 :          20            0       237427            0            1
 35 - 39 :           0            0            0         4403            0
 40 - 44 :      671169            0            0          547            0
 45 - 49 :           0     72969136            0      4313407            0
 50 - 54 :           0            0            0            0            0
 55 - 59 :           0            1            0            0            0
 60 - 64 :           0            0            0           90

cos: outgoing
-------------------------------

  0 -  4 :   469013728      3092379      3113570       510220      2244499
  5 -  7 :    74202699      5170814     72992272

My question is, where are all these different tag values being applied from? If all of the incoming traffic on all my switchports are either untagged or DSCP 46 / Cos 6, shouldn't all the outgoing traffic be the same?

[Gordon Ross]

If all of the incoming traffic on all my switchports are either untagged or DSCP 46 / Cos 6, shouldn't all the outgoing traffic be the same?

By default, the switch won't re-mark traffic, it'll just honour exist QoS markings and prioritise accordingly. As to why you're getting QoS markings all over the place: Have you examined the traffic on every port from every device? You'd be surprised at the rubbish modern PCs spit out on the network....

GTG

PS - This is probably better answered in the LAN Switching & Routing forum.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

As Gordon has noted, you've checked every other port on the 2960S, including any other stack members and/or trunk ports?

[Shaun Michelson]

I went through and looked at every port, and it seems to be mostly coming from our internet firewall (ASA5505), with our wireless access points coming in a distant second. Is that just the nature of internet traffic, or is there some misconfiguration occurring here?

Actually, that's only when looking at DSCP tagging. When I look at CoS tagging, the incoming traffic on every single interface is either untagged, or tagged CoS 6 (from our phones), but the outgoing traffic on all of the same interfaces has every CoS marking across the board, 0-7.

[Joseph W. Doherty · Accepted solution]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

So your saying your ingress tagging stats, for your firewall and/or WAPs, shows more than DSCP 0 and 46?  If so, yes they could account for the egress tagging stats you're seeing.

As to what's normal for Internet traffic, it's probably safe to say, there's no real normal.

As for the outgoing CoS markings, that might be due to DSCP values also being mapped to CoS values.  I.e. all your egress DSCP values could be creating all your egress CoS values.

[Shaun Michelson]

Yes, the ingress DSCP stats for those devices are all over the place. The DSCP-CoS mappings makes sense, i guess they don't get mapped on the way in, only on the way out?

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

I think the mapping is upon ingress, but you'll only see the resulting egress stats.

PS:

BTW, you could apply a service policy to any ingress port, controlling what DSCP/CoS marking you'll accept.