On an empty link QoS does nothing; on a full one it decides who suffers. That framing keeps the discipline honest: quality of service never creates bandwidth, it distributes delay, jitter and loss according to policy instead of arrival order. A 20-millisecond voice packet queued behind a backup transfer is a broken phone call; QoS exists so that outcome is a choice someone made rather than an accident nobody owns.
Classification and marking: decide once, at the edge
Traffic is sorted into classes by matching — DSCP, ACLs, protocol (NBAR), ingress interface, VLAN CoS. The design rule is to classify and mark at the trust boundary (the access switch or the voice gateway — not the untrusted PC), then let every downstream hop act on the marking alone. The common markings form a small vocabulary: EF (DSCP 46) for voice bearer traffic, CS-class values for signalling and control, AF41 for interactive video, AF31/AF21 tiers for data, best-effort 0 for the default class, CS1 for scavenger traffic that should lose first. In MPLS cores the DSCP maps into the label's 3-bit traffic-class field; QoS policy survives label switching because of that mapping.
class-map match-any VOICE match dscp efclass-map match-any VIDEO match dscp af41policy-map WAN-EDGE class VOICE priority percent 20 class VIDEO bandwidth percent 25 class class-default fair-queue random-detect dscp-basedinterface gi0/0 service-policy output WAN-EDGE
Queuing: how a full interface shares itself
- LLQ (priority) — the class is dequeued ahead of everything, capped at its rate so it cannot starve the rest: the only correct home for voice, and the cap is why 'priority percent 20', not 'priority everything'.
- CBWFQ (bandwidth) — each class is guaranteed its share during congestion and may exceed it when the link is idle; shares are minimums, not caps.
- WRED — inside a data queue, drop packets probabilistically as the queue deepens, preferring lower-precedence traffic, so TCP flows back off gradually instead of tail-drop synchronising every session at once.
- The unwritten class — everything unmatched lands in class-default; leaving it with fair queuing and some floor is what keeps 'miscellaneous' from meaning 'starved'.
Policing vs shaping
Both enforce a rate; their temperament differs. A policer drops (or re-marks) excess on the spot — no queue, no added delay; it is how providers enforce a purchased rate at ingress. A shaper buffers excess and releases it smoothly — added delay, no loss; it is how customers present conforming traffic to a policed service. The canonical pairing: the enterprise shapes egress to the contracted 100 Mbps (with the real queuing policy applied inside the shaper), and the provider polices ingress at 100 Mbps. Shape one side, police the other, and nobody's TCP sees random slaughter. Token-bucket arithmetic (CIR, Bc, Tc) governs both; the practical instinct is that small bursts are absorbed and sustained excess is disciplined.
Verification is one command and one habit: show policy-map interface gi0/0 prints per-class matches, queue depths and drops — read it during congestion, not after; an empty-network QoS test proves nothing. Then trust the design rule that underlies this whole chapter: few classes, marked once, queued consistently everywhere. Twelve-class policies that no two interfaces implement identically are how QoS earns its reputation for witchcraft; four classes done everywhere is how it earns SLAs.