BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← Linux
Lesson 1239 of 1,81910. Network Administration and Kernel StacksFree lesson

Traffic Class Mapping

Implement Differentiated Services Code Point (DSCP) marking in the kernel.

In this lesson, you will learn how to implement Differentiated Services Code Point (DSCP) marking directly within the Linux kernel to prioritize specific traffic classes.

Understanding DSCP Marking

While standard network configuration handles routing, Traffic Class Mapping is about how the kernel labels packets so that upstream routers and switches know how to treat them. DSCP is a field in the IP header that replaces the old Type of Service (ToS) byte. By setting these bits, you tell the network, "This packet is latency-sensitive (VoIP)" or "This packet is bulk data (backups)," ensuring your traffic gets the appropriate Quality of Service (QoS) treatment.

Implementing Marking via iptables

To mark traffic, we hook into the kernel’s mangle table. The mangle table is the correct location for this because it allows us to modify the IP header fields before the packet reaches the routing decision process.

Suppose you want to mark all outgoing VoIP traffic (destined for a specific RTP port range) with a DSCP value of 46 (commonly known as Expedited Forwarding). You can execute the following:

# Mark outgoing UDP packets on port range 10000-20000 with DSCP EF (46)
iptables -t mangle -A OUTPUT -p udp --dport 10000:20000 \
    -j DSCP --set-dscp 46

How it Works

  1. The Hook: By placing this rule in the OUTPUT chain of the mangle table, the kernel inspects the packet as it originates from your local process.
  2. The Transformation: The DSCP target modifies the 6 bits of the DSCP field in the IP header.
  3. Propagation: Once marked, the kernel attaches this metadata to the packet's sk_buff (socket buffer). When the packet exits the network interface, the physical header reflects this class, allowing hardware switches to place it into high-priority queues.

Unlike standard routing, this mapping is "sticky" for the duration of the flow's life, ensuring consistent performance for specialized applications without requiring per-packet software intervention once the flow is established.

Key Takeaway: DSCP marking in the kernel allows you to categorize traffic at the source, enabling granular, hardware-level prioritization across your entire network infrastructure.