QoS: Classification, Policing, Shaping and Queuing

Quality of service is what a router does when a link is busier than it is wide. OcNOS classifies traffic on ingress, meters it against a contracted rate, then queues, schedules and shapes it on egress, with the same configuration model across every routing and switching platform IP Infusion ships.

The QoS pipeline

A packet meets QoS twice. On the way in it is classified, optionally remarked, and metered against a policer. On the way out it is placed in a queue, selected by a scheduler, and released through a shaper. Each stage has its own standard and its own failure mode.

The QoS pipeline on an OcNOS router A packet path from left to right through six stages. Ingress: classify on interface, ACL, DSCP, IP precedence, RTP or 802.1p; mark or trust the existing DSCP and 802.1p values; police against a single-rate or two-rate three-color meter which may drop or remark. Egress: place into one of several hardware queues with WRED applied as the queue fills; select between queues with weighted round robin, weighted fair queuing or strict priority; release through a per-queue or per-port shaper. INGRESS EGRESS Classify ACL / DSCP / 802.1p Mark / Trust RFC 2474 Police srTCM / trTCM Queue WRED, RFC 2309 Schedule WRR / WFQ / SP Shape RFC 3644 drop or remark buffer and delay CLASSIFY · MARK · POLICE · QUEUE · SCHEDULE · SHAPE

Policing and shaping solve different problems

These two are routinely treated as interchangeable and they are not. A policer measures a flow and acts on the packet in front of it right now. Traffic inside the contracted rate goes through, traffic outside it is dropped or remarked to a lower priority, and nothing is stored. Because a policer never buffers, it adds no delay, and because it never delays, it cannot smooth anything. Bursts are cut rather than absorbed.

A shaper does the opposite. Excess traffic is held in a queue and released at the configured rate, so the profile leaving the port is smooth even when the traffic arriving was bursty. That protects a downstream link or a customer handoff from receiving more than it agreed to carry, but the smoothing is paid for in latency and buffer occupancy.

The practical split follows from that. Police on ingress to protect your own network from traffic that exceeds what was sold. Shape on egress to protect whatever sits downstream. Policing on an egress handoff will hit an application with drops it cannot see coming. Shaping on ingress simply moves your congestion problem into your own buffers.

Three colors, two ways to measure

Both OcNOS policers are three-color markers. Green is inside the committed rate, yellow is inside the burst allowance, red is out of contract. What differs is how the rate is measured. A single-rate three-color marker (RFC 2697) works from one rate with a committed and an excess burst, which suits a contract that permits bursts but not a sustained higher rate. A two-rate three-color marker (RFC 4115) measures a committed rate and a peak rate independently, which suits a contract with a genuine hard ceiling above the committed rate. Both are available on all 26 service provider and 18 data center platforms.

What OcNOS implements

Classification

Match on what is actually there

Interface, access list, DSCP, IP precedence, RTP or 802.1p, following the DiffServ architecture in RFC 2475. A port can also be set to trust the 802.1p or DSCP values already applied upstream instead of reclassifying.

Policing

srTCM and trTCM

Single-rate three-color metering per RFC 2697 and two-rate three-color metering per RFC 4115, with drop or remark on the out-of-contract color. Available across the full platform set.

Congestion avoidance

WRED before overflow

Weighted Random Early Detection per RFC 2309 drops a rising share of packets as the queue builds, so senders back off before a tail drop takes out every flow at once.

Scheduling

WRR, WFQ and strict priority

Weighted round robin, weighted fair queuing and strict priority across multiple hardware queues per port, with the service-class guidance in RFC 4594 as the starting point. Minimum and maximum bandwidth can be set per queue.

Shaping

Per queue and per port

Rate shaping applied to an individual queue or to the port as a whole, per the policy model in RFC 3644, so an aggregate ceiling and per-class ceilings can coexist on the same interface.

Verification

Counters that answer the question

Class-map statistics and per-egress-queue counters, so a policy can be shown to be matching the traffic you think it is matching, and a queue can be shown to be draining.

Where service provider and data center platforms differ

Most of the QoS toolkit is common to both platform families, but three capabilities are not, and assuming otherwise is a design error worth catching early.

  • Hierarchical queuing is a service provider capability. A one, two or three level queuing hierarchy (RFC 3644) lets a port-level shaper sit above per-service queues, which is what a carrier Ethernet handoff or a business-services aggregation port needs. It is available on all 26 service provider platforms and is not part of the data center set. The related service-queuing model, which maps services to VLANs and shapes each one, has the same scope.
  • Explicit Congestion Notification is a data center capability. ECN (RFC 3168) marks packets instead of dropping them so the endpoint can react, which is what makes lossless RDMA transport workable. It is available on 16 data center platforms. On an AI or storage fabric it is the foundation that DCQCN builds on, alongside PFC.
  • Remarking of bridged packets is a data center capability, available on all 18 data center platforms.

If a design depends on one of these, confirm the platform first. The Feature-Matrix carries the per-platform detail, and the Hardware-Kompatibilitätsliste maps it to the routers and switches those features run on.

Working out a QoS policy for a real handoff?

Talk to an engineer →
FAQ

Häufig gestellte Fragen

What is QoS on a router?
Quality of service is the set of mechanisms a router uses to decide which packets get forwarded first, which get delayed, and which get dropped when a link is busy. On OcNOS that runs as a pipeline: classify the traffic, mark it, police it against a contracted rate on ingress, then queue, schedule and shape it on egress.
What is the difference between traffic policing and traffic shaping?
Policing measures a flow against a rate and acts immediately: traffic above the rate is dropped or remarked to a lower priority, and nothing is stored. Shaping holds excess traffic in a queue and releases it at the configured rate, so the flow is smoothed instead of cut. Policing protects the network and is normally applied on ingress. Shaping protects the far end and is applied on egress, at the cost of added delay and buffer use.
What is WRED and why use it?
Weighted Random Early Detection drops a small, increasing share of packets as a queue fills, rather than waiting for the queue to overflow and dropping everything at once. Following RFC 2309, this signals congestion to senders early and keeps flows from synchronizing into a repeating collapse and recovery cycle. OcNOS supports WRED across all 26 service provider and 18 data center platforms.
What are srTCM and trTCM?
They are the two standard three-color metering schemes used for policing. A single-rate three-color marker (RFC 2697) measures one rate with a committed and an excess burst, coloring traffic green, yellow or red. A two-rate three-color marker (RFC 4115) measures a committed rate and a peak rate separately. OcNOS implements both, so a policer can either allow bursts against one rate or enforce a distinct peak ceiling.
Does OcNOS support hierarchical QoS?
Yes, on the service provider platforms. OcNOS supports a one, two or three level queuing hierarchy (RFC 3644), so an aggregate port shaper can sit above per-service or per-customer queues. Hierarchical queuing and the related per-service queuing model are service provider features and are not part of the data center platform set.
What can OcNOS classify traffic on?
Classification can match on the incoming interface, an access list, DSCP, IP precedence, RTP, or the 802.1p priority bits, following the DiffServ architecture in RFC 2475. A router can also be told to trust the 802.1p or DSCP values a neighbour has already set, which avoids reclassifying traffic that was marked correctly at the network edge.