DSCP stands for Differentiated Services Code Point, a 6-bit value in the header of every IP packet that tells network equipment how to prioritize that packet. Think of it as a label stamped on each piece of network traffic: voice calls get a high-priority label, bulk file downloads get a low-priority one, and routers along the path read that label to decide which packets go first when the network is congested. With 6 bits, DSCP supports 64 possible values (0 through 63), giving network administrators fine-grained control over traffic handling.
Where DSCP Lives in the Packet
Every IPv4 packet has a byte near the front of its header originally called the Type of Service (TOS) field. In 1998, the Internet Engineering Task Force (IETF) redefined that byte via RFC 2474, replacing the old TOS definition with something called the Differentiated Services (DS) field. The top 6 bits of that byte became the DSCP value. The bottom 2 bits were reserved and later assigned to Explicit Congestion Notification (ECN), a separate mechanism that helps routers signal congestion without dropping packets.
IPv6 has the same setup. Its Traffic Class field contains the 6-bit DSCP value in the most significant bits, with ECN occupying the remaining two. The structure is identical across both protocols, so the same DSCP markings work regardless of IP version.
Why DSCP Replaced IP Precedence
Before DSCP existed, IPv4 used only 3 bits for traffic classification, a system called IP Precedence. Three bits meant just 8 possible priority levels, which was too coarse for modern networks juggling voice, video, signaling, database traffic, and everything else. DSCP expanded that to 6 bits and 64 possible values, allowing much more granular classification while still fitting in the same byte of the header.
Backward compatibility was a real concern during the transition. To handle it, the standard includes Class Selector (CS) values that map directly to the old IP Precedence levels. CS1 through CS7 use only the top 3 bits (the same 3 bits IP Precedence used), with the lower 3 bits set to zero. A legacy device that only reads IP Precedence still sees a meaningful priority value, while a modern device reads the full 6-bit DSCP marking. This made it possible for old and new equipment to coexist on the same network.
Standard DSCP Classes
You don’t have to memorize all 64 possible values. In practice, most networks use a handful of well-known markings organized into three groups: Class Selectors, Assured Forwarding, and Expedited Forwarding.
Class Selectors (CS0 through CS7)
These are the backward-compatible values. CS0 (decimal 0) is the default, best-effort traffic. CS1 (decimal 8) corresponds to the old “Priority” level. CS5 (decimal 40) maps to “Critic/Critical,” and CS6 (decimal 48) maps to “Internetwork Control,” typically reserved for routing protocols and network management. Higher CS numbers mean higher priority.
Assured Forwarding (AF)
Assured Forwarding gives you four traffic classes, each with three drop precedence levels. The naming convention is AFxy, where x is the class (1 through 4) and y is the drop precedence (1 through 3). Higher classes get better forwarding treatment, while higher drop precedence means the packet is more likely to be discarded during congestion.
For example, AF41 (decimal 34) is the highest AF class with the lowest drop probability, making it a common choice for interactive video. AF43 (decimal 38) is the same class but with high drop probability, meaning those packets get dropped first when the network gets tight. This layered approach lets you protect important traffic within each class while still giving routers flexibility to manage congestion.
The full AF table:
- AF1x: AF11 (10), AF12 (12), AF13 (14)
- AF2x: AF21 (18), AF22 (20), AF23 (22)
- AF3x: AF31 (26), AF32 (28), AF33 (30)
- AF4x: AF41 (34), AF42 (36), AF43 (38)
Expedited Forwarding (EF)
EF (decimal 46) is the premium marking, designed for traffic that needs low latency, low jitter, and low packet loss. Voice over IP is the textbook use case. When a router sees a packet marked EF, it places that packet into a strict priority queue so it gets forwarded ahead of nearly everything else. The tradeoff is that EF traffic should be rate-limited; if too much traffic claims EF priority, it defeats the purpose and can starve other traffic classes.
Common Real-World Markings
Different applications and vendors apply DSCP markings based on widely accepted conventions. VoIP audio is almost universally marked EF (46). Interactive video often gets AF41 (34), and signaling traffic for call setup typically receives CS3 (24).
Some vendors use their own defaults. Zoom, for instance, marks audio traffic with DSCP 56 (CS7) and video with 40 (CS5) by default, though administrators can adjust these values to match their network’s QoS policy. This highlights an important point: DSCP markings only matter if the network equipment along the path is configured to honor them. A router that hasn’t been set up with matching Quality of Service rules will treat every packet the same regardless of its DSCP value.
How DSCP Maps to Layer 2 Priority
DSCP operates at Layer 3 (the IP layer), but traffic also passes through Layer 2 switches that use a different priority system. On VLAN-tagged Ethernet frames, priority is handled by a 3-bit field called the Priority Code Point (PCP), part of the 802.1p standard. Since PCP only has 3 bits, it supports just 8 priority levels (0 through 7).
The conversion is straightforward: network devices take the upper 3 bits of the DSCP value and copy them into the PCP field. A DSCP value of 48 (binary 110000) has upper bits of 110, which equals 6 in decimal, so the PCP value becomes 6. DSCP values 0 through 7 map to PCP 0 (best effort), 8 through 15 map to PCP 1, 16 through 23 map to PCP 2, and so on. This keeps priority consistent as packets move between routers and switches.
How Routers Use DSCP Values
Marking a packet is only half the story. The real work happens at each router along the path, where a behavior called Per-Hop Behavior (PHB) determines how marked packets are actually treated. A router might place EF-marked packets into a low-latency queue, give AF41 packets a guaranteed bandwidth allocation, and send CS0 best-effort traffic through whatever capacity remains.
During congestion, routers use the drop precedence within AF classes to decide which packets to discard first. An AF11 packet (low drop precedence) survives longer than an AF13 packet (high drop precedence) within the same class. This selective dropping lets the network degrade gracefully rather than randomly discarding packets from all traffic equally.
DSCP markings can also be rewritten at network boundaries. An ISP might strip or remark DSCP values on traffic entering its network, applying its own QoS policy instead of trusting whatever the customer marked. This is called trust boundaries, and it means DSCP-based QoS is most effective within a single administrative domain, like a corporate LAN or a managed WAN service where you control the equipment end to end.