Examination of the DSCP field
The Diffserv field or Type of Service [ToS] byte is the second byte in an IPv4 packet. The first three bits (by themselves) of the ToS byte are referred to as the IP Precedence bits. These same bits, in conjunction with the next three bits, are known collectively as the DSCP or Differentiated Services Code Point bits.
Figure 1: IP Packet and ToS or Diffserv Field
Per Hop Behaviors [PHB]
The Internet Engineering Task Force [IETF] has defined PerHop Behaviors [PHB] for traffic marking. These are defined in RFC 2597 and RFC 2598. PHB’s (like Type of Service and Class of Service bits) are used to identify service levels to be provided by nodes in the network infrastructure. They can be directly related to a DSCP decimal value. PHB and DSCP are becoming ever more important as the IETF continues to standardize DiffServ specifications.
The three broader classes of PHBs are:
 Best Effort (BE or DSCP 0)
 Assured Forwarding (AFxy)
 Expedited Forwarding (EF or DSCP 46)
EF is equal to 101 in bits 5 through 7 of the ToS byte, or an IP Precedence of 5. AF is equal to 001, 010, 011 or 100 in bits 5 through 7 of the ToS byte, or an IP precedence of 1, 2, 3, or 4.
That is AF1, AF2, AF3, and AF4 or 001, 010, 011, or 100.
Looking at figure 2, focus on the 3 most significant bits for precedence and AF class. Can you see how 001 = 1, 010 = 2, 011 = 3 and 100 = 4? And of course EF is equal to 101 in bits 5 .7.
Figure 2: Blank Conversion Template
In addition to the class selector, the PHB AF class has 3 subclasses determined by the next 2 bits. These AF subclasses are called the droppreference. So all together we have:
AF11

AF12

AF13

AF21

AF22

AF23

AF31

AF32

AF33

AF41

AF42

AF43

Notice that AF11, AF12, and AF13 are still equal to 001, or IP precedence of 1 in the three most significant bits. Same with the other AF class selectors. AF2 is IP precedence 2 or 010 bitwise. AF42 would refer to Assured Forwarding Class 4 droppreference 2. Look at figure 2 again. Do you see the drop preference or AF class selector?
DSCP values can be expressed in decimal form or with PHB keywords; for example DSCP EF is synonymous with DSCP 46, also DSCP AF31 is synonymous with DSCP 26. This will become clear as we work conversions.
Figure 2 shows a blank conversion template with the individual ToS bit places marked. Notice that some of the least significant bit places are not used in conversion. The three least significant bits are not used for PHB and the two least significant are not used for DSCP. So using the table we can convert any DSCP to Precedence, PHB, ToS and vice versa. Here are some examples.
Converting to IP Precedence, Per Hop Behaviors (PHB), ToS and vice versa
DSCP to PHB to Precedence and ToS examples
For our first example we will use DSCP value 36 and show how to easily determine its IP Precedence, PHB and ToS value. You can draw out your bits like the figure. For example 100100 for DSCP 36, as the figure shows.
Figure 3 DSCP value of 36, Precedence of 4, ToS of 144
Looking at figure 3 you can easily see that a dscp of 36 is equal to an IP Precedence value of 4 and a PHB of AF42.
You might also be asking how we arrived at ToS of 144. Well the simplest way to do that is to multiply DSCP by 4. Or you can add another row to the conversion table as we did for clarity in figure 4.
Figure 4 ToS value added for clarity, but can be calculated using DSCP x 4
Let’s look at another example.
In the next example we will use DSCP 18. Looking at figure 5, the ToS byte is equal to 72. This equates to an IP precedence of 2 and a DSCP value of 18.
Figure 5: ToS byte is 72, DSCP is 18, PHB is AF21 and IP Precedence is 2
Are you getting it? Try a few on your own.
A little more about PHB EF and AF values
Here is a complete table of AF values
AF11 AF12 AF13
AF21 AF22 AF23
AF31 AF32 AF33
AF41 AF42 AF43
This table represents the 4 AF subclasses and the three drop probabilities or “class selectors” that can be applied to each subclass. I just want to point out that this is what these are. There is a high, medium and no drop probability for the AF1 class. There is a high, medium and no drop probability for the AF2 subclass and the same for AF3 and AF4.
The Expedited Forwarding EF takes precedence over the other PHB values. Just to point out, Voice traffic on an IP network is normally marked with an IP Precedence of 5. Well, that is what EF equals right? 101 in bits 57 of the ToS byte.
EF is DSCP 46. Let’s use our table and look at that.
Figure 6: EF Phb is IP Precedence of 5 with no drop probability
Look at figure 6 and notice that EF is backwards compatible with an IP Precedence of 5 (Voice traffic) and has a drop probability equal to 3 or no drop. Perfect for voice!!