Understanding Differentiated Services (TOS) field in Internet Protocol Header

IP is the main backbone protocol of the internet(also it is one of the main protocol inside the TCP/IP protocol suite). In other words, irrespective of whether you are using TCP, UDP, or ICMP, the actual data gets transmitted using IP protocol.  IP does not provide any guarantee about delivery, it is completely connectionless. Hence, it is the responsibility of the protocols above IP in the layer to provide proper error free delivery(ie: TCP).

Similar to other protocols, apart from the data it carries, IP also has some details and control information attached to each message(ie: each ip datagram). This information tells how the datagram should be interpreted and operated upon. This is generally referred to as protocol headers. The IP protocol header looks like the below.

The IP protocol header is typically of the size 20 bytes. Well it can go up to 60 bytes depending upon whether the option field is set. Options field itself can be of maximum 40 bytes(which generally is of 0, and hence the total header size in most cases is of 20 bytes).

The topic that we are going to discuss in this article, is highlighted in the header diagram above. It is the DS Field and ECN Field. In the above shown header diagram, the third and the fourth field indicates DS & ECN.

DS Stands for Differentiated Services.

ECN Stands for Explicit Congestion Notification.

Earlier we discussed that headers are nothing but control information that describes how a particular protocol message needs to be interpreted and operated. So basically each and every field that you see in the header section conveys some control settings that the destination and intermediate devices pay attention to.

Imagine a situation where we need to flag an ip datagram as "higher priority" so that the routers and networking devices that comes between the source and destination can treat this one datagram a bit differently than others.  The DS field in the header provides the capability to do just that.

Basically a number (which has a predifined meaning) is placed on to the DSfield, which other networking devices will read and take necessary action depending upon its meaning. This number is actually called DSCP.

DSCP stands for Differentiated Services Code Point.

It is called as "Code Point" because of a particular arrangement of bits which convey some meaning.  DSfield actually replaces something which was earlier called as TOS (Type of service) in the IP header, which is mentioned in the below RFC Document from IETF.

Read: DSField replaces TOS octect in IP Header

Let me reiterate what I just said. Yes it was earlier called as TOS field in the IP header. TOS(Type of Service) header field originally had 8 bits. These 8 bits were not fully used for TOS (although the header was called TOS). Out of 8, only 4 bits were used for TOS, and then 3 bits were used for something called as "IP Precedence". The very last bit was not used at all. To make this clear...

When we say "precedence" here, it is the priority or importance of the ip packet.

TOS IP Header (8 bit) = 4 bit TOS + 3 bit IP precedence + 1 bit unused.

IP precedence is 3 bit as mentioned above. Which means it is nothing but a combination of three numbers(1s and 0s), which indicate a predefined meaning. For example, 101 might indicate "Voice", 010 might indicate "priority is high", 001 might indicate "Medium priority" etc.

4 bit TOS is field is actually used to indicate throughput type, reliability type, delay type, and cost. For example, if the 4 bits of TOS has a value of 1111 (this might indicate low delay, high throughput, high reliability and minimized cost). But these 4 bits were usually left unused similar to the last bit.

So the bottom line is the fact that only the 3 bit IP precedence was generally in use. Rest of the bits were not generally used.  3 bits of IP precedence means that there are 2^3 = 8 possible values for it. See the table below. It describes all those 8 possible values that can be constructed from those 3 IP precedence bits.

The above shown diagram depicts the TOS field(octect) in the IP header, and its components that we discussed.

On a side note: Please keep the fact in mind that there is no mechanism in TCP to specify the priority. In fact TCP leverages the facility given by the IP header (IP Precedence field that we saw above) to set priority and importance of a particular connection. Being said that, in case the priority or importance of an IP packet that is part of an ongoing TCP connection gets changed, the destination will consider it as an error and mostly will drop the packet. In short the TCP connection will have to be re-established. So TCP will not accept any change in priority of an already established connection.

TOS was 8 bit field, which after the RFCs 2474 and 3168 is now divided into two seperate components. DS (Differentiated Services Field) which is of 6 bits & Explicit Congestion Notification (ECN) which is of 2 bits.  The 6bit DS field is used for DSCP (differentiated Services Code Point).

Actually I should redraw the diagram above after RFC 2474 and call it DS field (it should look like the below.)

DSCP has 6 bits. This means there can be 64 (2^6) different possible codes that can be constructed using these bits. These possible DSCP convey different meanings based upon which intermediate networking devices can take appropriate action. Quite a few of these possible values have already been standardized. The details about these standardized DSCP values can be found from IANA.

The default value of DSCP is 0 0 0 0 0 0(6 bits). Actually the three bits (0,1,2), which was earlier used for IP precedence is still being used for the same purpose of "priority". This actually provides some level of backward compatibility. The networking devices that support "Differetiated Services", will actually select a behaviour depending upon the 6 DSCP bits. It(the behaviour selected) is called PHB. PHB stands for Per Hop Behaviour.

The 3 IP precedence bit is now being used in DSCP to classify the traffic. In fact it is called the class selector bits. Before we proceed further, lets first understand few keywords used in DSCP terminology.

Few minutes back i mentioned that DSCP is still maintaining some backward compatibility with the old TOS field. This backward compatibility is achieved because of the fact that the IP Precedence bits is now used as "Class Selector". 

The mapping of behaviours to DSCP codes can be done on the networking devices that support differentiated services.

Per Hop Behaviour is nothing but the kind of treatment given to the packet. The kind of treatment is actually selected by the networking device by looking at the 6 bit DSCP field. Please keep the fact in mind that the 6th and the 7th bit are not considered while selecting the per hop behaviour.

Networking devices can configure the mapping of a particular treatment (PHB) to a DSCP code.

Now imagine a situation where a networking device recieves a packet with an unrecognised DSCP code. In this case the ideal behaviour should be that the networking device should not tampter and alter the DSCP, it should forward it similar to other packets with default DSCP (000000).

Also it is quite possible that a network paket can travel through multiple network domains with different types of devices. The intermediate network domains can actually alter the DSCP in their domain to have a particular treatment only in that domain.

As mentioned earlier, the IP Precedence bit in DSCP terminology is used as class selector. Class selector code points (DSCP) will always be of the below format.

X X X 0 0 0

Remember that DSCP is of 6 bits. The first 3 bits of IP precedence is indicated by X X X above. As the IP Precedence field is of 3 bits (those three X), there can be 2^3 = 8 possible class selector DSCPs (the last 3 bits will always be 0 in these 8 possible values.)

Keep in mind that packets that has higher class values are treated better compared to others. Which means, a packet in the class CS5 will get better treatement compared to a packet in CS4 class. Note: CS6 and CS7 is reserved for network protocol and control related stuff. This means that CS5 class value is the highest class value.

Lets take CS1 to CS4 and discuss it a bit further (Why not CS0 and CS5?. It is because CS0 is default and there is no more classification in there and CS5 is the highest class, and we will discuss it seperately.)

These classes can be further catogorized by assigning something called as "Drop Precedence" to each them. Each of these classes can be assigned with a Low, High, and Medium drop precedence. Which means there can 3 possible categories in each class (ie: CS1 to CS4). To make it a bit more clear, catogory 1 in CS1 will have Low drop precedence, catogory 2 in CS1 will have Medium drop precedence, and catogory 3 in CS1 will have drop precedence High.

Let's number these drop precedence values as below.

Actually these three catogories in each class is called as Assured Forwarding (AF).

AF11 means that it is of class CS1 and catogory 1 (ie: Low drop precedence. Low is indicated by 1)

AF12 means that it is of class CS1 and catogory 2 (ie: Medium drop precedence. See above, Medium is indicated by 2)

AF13 means that it is of class CS1 and catogory 3 (ie: High drop precedence. High is indicated by 3)

Similarly.... AF21, AF22, AF23, AF31, AF32....AF41, AF42, AF43

Keep the fact in mind that packets having higher drop precedence values is more likely to be dropped during network issues. So basically packets with DSCP value of AF23 is more likely to be dropped than packets with the DSCP of AF21. The 6 bit binary mappings of AF DSCPs are below.

I mentioned that we will be discussing CS5 later. It is because CS5 is the highest class and is actually used for most critical traffic. CS5 does not have drop precedence at all.

This class is generally called as Expedited Forwarding(EF). Real time communication services like voice and video traffic uses EF PHB(Expedited Forwarding Per Hop Behaviour).

EF is given the highest priority compared to all other class catogories. Below is the binary notion.