IP Quality of Service (IPQoS) enables you to prioritize, control, and gather accounting statistics. Using IPQoS, you can provide consistent levels of service to users of your network. You can also manage traffic to avoid network congestion.
The following is a list of topics in this chapter:
IPQoS enables the Differentiated Services (Diffserv) architecture that is defined by the Differentiated Services Working Group of the Internet Engineering Task Force (IETF). In Oracle Solaris, IPQoS is implemented at the IP level of the TCP/IP protocol stack.
By enabling IPQoS, you can provide different levels of network service for selected customers and selected applications. The different levels of service are collectively referred to as differentiated services. The differentiated services that you provide to customers can be based on a structure of service levels that your company offers to its customers. You can also provide differentiated services based on the priorities that are set for applications or users on your network.
Delegating levels of service to different groups, such as customers or departments in an enterprise
Prioritizing network services that are given to particular groups or applications
Discovering and eliminating areas of network bottlenecks and other forms of congestion
Monitoring network performance and providing performance statistics
Regulating bandwidth to and from network resources
ipqosconf Command-line tool for configuring the QoS policy
Classifier that selects actions, which are based on filters that configure the QoS policy of your organization
Metering module that measures network traffic, in compliance with the Diffserv model
Service differentiation that is based on the ability to mark a packet's IP header with forwarding information
Flow-accounting module that gathers statistics for traffic flows
Statistics gathering for traffic classes, through the UNIX® kstat command
Support for SPARC® and x86 architecture
Support for IPv4 and IPv6 addressing
Interoperability with IP Security Architecture (IPsec)
Support for 802.1D user-priority markings for virtual local area networks (VLANs)
You can find information on differentiated services and quality of service from print and online sources.
For more information on quality-of-service theory and practice, refer to the following books:
Ferguson, Paul and Geoff Huston. Quality of Service. John Wiley & Sons, Inc., 1998.
Kilkki, Kalevi. Differentiated Services for the Internet. Macmillan Technical Publishing, 1999.
RFC 2474, Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers – Describes an enhancement to the type of service (ToS) field or DS fields of the IPv4 and IPv6 packet headers to support differentiated services
RFC 2475, An Architecture for Differentiated Services – Provides a detailed description of the organization and modules of the Diffserv architecture
RFC 2597, Assured Forwarding PHB Group – Describes how the assured forwarding (AF) per-hop behavior works.
RFC 2598, An Expedited Forwarding PHB – Describes how the expedited forwarding (EF) per-hop behavior works
Internet-Draft, An Informal Management Model for Diffserv Routers – Presents a model for implementing the Diffserv architecture on routers.
The Differentiated Services Working Group of the IETF maintains a web site with links to Diffserv Internet drafts at http://www.ietf.org/html.charters/diffserv-charter.html.
Router manufacturers such as Cisco Systems and Juniper Networks provide information on their corporate web sites that describes how Differentiated Services are implemented in their products.
ipqosconf(1M) - Describes the command for setting up the IPQoS configuration file
ipqos(7ipp) – Describes the IPQoS implementation of the Diffserv architectural model
ipgpc(7ipp) – Describes the IPQoS implementation of a Diffserv classifier
tokenmt(7ipp) – Describes the IPQoS tokenmt meter
tswtclmt(7ipp) – Describes the IPQoS tswtclmt meter
dscpmk(7ipp) – Describes the DSCP marker module
dlcosmk(7ipp) – Describes the IPQoS 802.1D user-priority marker module
flowacct(7ipp)– Describes the IPQoS flow-accounting module
acctadm(1M) – Describes the command that configures the Oracle Solaris extended accounting facilities. The acctadm command includes IPQoS extensions.
IPQoS features enable Internet service providers (ISPs) and application service providers (ASPs) to offer different levels of network service to customers. These features enable individual companies and educational institutions to prioritize services for internal organizations or for major applications.
If your organization is an ISP or ASP, you can base your IPQoS configuration on the service-level agreement (SLA) that your company offers to its customers. In an SLA, a service provider guarantees to a customer a certain level of network service that is based on a price structure. For example, a premium-priced SLA might ensure that the customer receives highest priority for all types of network traffic 24 hours per day. Conversely, a medium-priced SLA might guarantee that the customer receives high priority for email only during business hours. All other traffic would receive medium priority 24 hours a day.
If your organization is an enterprise or an institution, you can also provide quality-of-service features for your network. You can guarantee that traffic from a particular group or from a certain application is assured a higher or lower degree of service.
You implement quality of service by defining a quality-of-service (QoS) policy. The QoS policy defines various network attributes, such as customers' or applications' priorities, and actions for handling different categories of traffic. You implement your organization's QoS policy in an IPQoS configuration file. This file configures the IPQoS modules that reside in the Oracle Solaris kernel. A host with an applied IPQoS policy is considered an IPQoS-enabled system.
Discrete groups of network traffic that are called classes of service.
Metrics for regulating the amount of network traffic for each class. These metrics govern the traffic-measuring process that is called metering.
An action that an IPQoS system and a Diffserv router must apply to a packet flow. This type of action is called a per-hop behavior (PHB).
Any statistics gathering that your organization requires for a class of service. An example is traffic that is generated by a customer or particular application.
When packets pass to your network, the IPQoS-enabled system evaluates the packet headers. The action that the IPQoS system takes is determined by your QoS policy.
Tasks for designing the QoS policy are described in Planning the Quality-of-Service Policy.
IPQoS contains features that can help you make network performance more efficient as you implement quality of service. When computer networks expand, the need also increases for managing network traffic that is generated by increasing numbers of users and more powerful processors. Some symptoms of an overused network include lost data and traffic congestion. Both symptoms result in slow response times.
In the past, system administrators handled network traffic problems by adding more bandwidth. Often, the level of traffic on the links varied widely. With IPQoS, you can manage traffic on the existing network and help assess where, and whether, expansion is necessary.
For example, for an enterprise or institution, you must maintain an efficient network to avoid traffic bottlenecks. You must also ensure that a group or application does not consume more than its allotted bandwidth. For an ISP or ASP, you must manage network performance to ensure that customers receive their paid-for level of network service.
You can use IPQoS to regulate network bandwidth, the maximum amount of data that a fully used network link or device can transfer. Your QoS policy should prioritize the use of bandwidth to provide quality of service to customers or users. The IPQoS metering modules enable you to measure and control bandwidth allocation among the various traffic classes on an IPQoS-enabled host.
Before you can effectively manage traffic on your network, you must answer these questions about bandwidth usage:
What are the traffic problem areas for your local network?
What must you do to achieve optimum use of available bandwidth?
What are your site's critical applications, which must be given highest priority?
Which applications are sensitive to congestion?
What are your less critical applications, which can be given a lower priority?
To implement quality of service, you analyze network traffic to determine any broad groupings into which the traffic can be divided. Then, you organize the various groupings into classes of service with individual characteristics and individual priorities. These classes form the basic categories on which you base the QoS policy for your organization. The classes of service represent the traffic groups that you want to control.
For example, a provider might offer platinum, gold, silver, and bronze levels of service, available at a sliding price structure. A platinum SLA might guarantee top priority to incoming traffic that is destined for a web site that the ISP hosts for the customer. Thus, incoming traffic to the customer's web site could be one traffic class.
For an enterprise, you could create classes of service that are based on department requirements. Or, you could create classes that are based on the preponderance of a particular application in the network traffic. Here are a few examples of traffic classes for an enterprise:
Popular applications such as email and outgoing FTP to a particular server, either of which could constitute a class. Because employees constantly use these applications, your QoS policy might guarantee email and outgoing FTP a small amount of bandwidth and a lower priority.
An order-entry database that needs to run 24 hours a day. Depending on the importance of the database application to the enterprise, you might give the database a large amount of bandwidth and a high priority.
A department that performs critical work or sensitive work, such as the payroll department. The importance of the department to the organization would determine the priority and amount of bandwidth you would give to such a department.
IPQoS adds the following enhancements to the Diffserv model:
802.1D datagram marker
This section introduces the Diffserv modules as they are used by IPQoS. You need to know about these modules, their names, and their uses to set up the QoS policy. For detailed information about each module, refer to IPQoS Architecture and the Diffserv Model.
In IPQoS, these fields are referred to as the 5-tuple.
The IPQoS classifier module is named ipgpc. The ipgpc classifier arranges traffic flows into classes that are based on characteristics you configure in the IPQoS configuration file.
For detailed information about ipgpc, refer to Classifier Module.
A class is a group of network flows that share similar characteristics. For example, an ISP might define classes to represent the different service levels that are offered to customers. An ASP might define SLAs that give different levels of service to various applications. For an ASP's QoS policy, a class might include outgoing FTP traffic that is bound for a particular destination IP address. Outgoing traffic from a company's external web site might also be defined as a class.
Grouping traffic into classes is a major part of planning your QoS policy. When you create classes by using the ipqosconf utility, you are actually configuring the ipgpc classifier.
For information on how to define classes, see How to Define the Classes for Your QoS Policy.
Filters are sets of rules that contain parameters called selectors. Each filter must point to a class. IPQoS matches packets against the selectors of each filter to determine if the packet belongs to the filter's class. You can filter on a packet by using a variety of selectors, for example, the IPQoS 5-tuple and other common parameters:
Source address and destination addresses
Source port and destination port
Differentiated Services Codepoint (DSCP)
For example, a simple filter might include the destination port with the value of 80. The ipgpc classifier then selects all packets that are bound for destination port 80 (HTTP) and handles the packets as directed in the QoS policy.
For information on creating filters, see How to Define Filters in the QoS Policy.
In the Diffserv model, the meter tracks the transmission rate of traffic flows on a per-class basis. The meter evaluates how much the actual rate of the flow conforms to the configured rates to determine the appropriate outcome. Based on the traffic flow's outcome, the meter selects a subsequent action. Subsequent actions might include sending the packet to another action or returning the packet to the network without further processing.
Both metering modules recognize three outcomes: red, yellow, and green. You define the actions to be taken for each outcome in the parameters red_action_name, yellow_action_name, and green_action_name.
In addition, you can configure tokenmt to be color aware. A color-aware metering instance uses the packet's size, DSCP, traffic rate, and configured parameters to determine the outcome. The meter uses the DSCP to map the packet's outcome to a green, yellow, or red.
For information on defining parameters for the IPQoS meters, refer to How to Plan Flow Control.
In the Diffserv model, the marker marks a packet with a value that reflects a forwarding behavior. Marking is the process of placing a value in the packet's header to indicate how to forward the packet to the network. IPQoS contains two marker modules:
dscpmk – Marks the DS field in an IP packet header with a numeric value that is called the Differentiated Services codepoint, or DSCP. A Diffserv-aware router can then use the DS codepoint to apply the appropriate forwarding behavior to the packet.
dlcosmk – Marks the virtual local area network (VLAN) tag of an Ethernet frame header with a numeric value that is called the user priority. The user priority indicates the class of service (CoS), which defines the appropriate forwarding behavior to be applied to the datagram.
dlcosmk is an IPQoS addition that is not part of the Diffserv model, as designed by the IETF.
For information on implementing a marker strategy for the QoS policy, see How to Plan Forwarding Behavior.
IPQoS adds the flowacct accounting module to the Diffserv model. You can use flowacct to gather statistics on traffic flows, and bill customers in agreement with their SLAs. Flow accounting is also useful for capacity planning and system monitoring.
Number of packets
Number of bytes
You can also gather statistics on other attributes, as described in Recording Information About Traffic Flows, and in the flowacct(7ipp) and acctadm(1M) man pages.
For information on planning a flow-accounting strategy, see How to Plan for Flow Accounting.
This figure illustrates a common traffic flow sequence on an IPQoS-enabled machine:
The classifier selects from the packet stream all packets that match the filtering criteria in the system's QoS policy.
The selected packets are then evaluated for the next action to be taken.
The classifier sends to the marker any traffic that does not require flow control.
Traffic to be flow-controlled is sent to the meter.
The meter enforces the configured rate. Then, the meter assigns a traffic conformance value to the flow-controlled packets.
The flow-controlled packets are then evaluated to determine if any packets require accounting.
The meter sends to the marker any traffic that does not require flow accounting.
The flow-accounting module gathers statistics on received packets. The module then sends the packets to the marker.
The marker assigns a DS codepoint to the packet header. This DSCP indicates the per-hop behavior that a Diffserv-aware system must apply to the packet.
This section introduces the elements that are involved in forwarding packets on an IPQoS-enabled network. An IPQoS-enabled system handles any packets on the network stream with the system's IP address as the destination. The IPQoS system then applies its QoS policy to the packet to establish differentiated services.
The DS codepoint (DSCP) defines in the packet header the action that any Diffserv-aware system should take on a marked packet. The diffserv architecture defines a set of DS codepoints for the IPQoS-enabled system and diffserv router to use. The Diffserv architecture also defines a set of actions that are called forwarding behaviors, which correspond to the DSCPs. The IPQoS-enabled system marks the precedence bits of the DS field in the packet header with the DSCP. When a router receives a packet with a DSCP value, the router applies the forwarding behavior that is associated with that DSCP. The packet is then released onto the network.
The dlcosmk marker does not use the DSCP. Rather, dlcosmk marks Ethernet frame headers with a CoS value. If you plan to configure IPQoS on a network that uses VLAN devices, refer to Marker Module.
In Diffserv terminology, the forwarding behavior that is assigned to a DSCP is called the per-hop behavior (PHB). The PHB defines the forwarding precedence that a marked packet receives in relation to other traffic on the Diffserv-aware system. This precedence ultimately determines whether the IPQoS-enabled system or Diffserv router forwards or drops the marked packet. For a forwarded packet, each Diffserv router that the packet encounters en route to its destination applies the same PHB. The exception is if another Diffserv system changes the DSCP. For more information on PHBs, refer to Using the dscpmk Marker for Forwarding Packets.
The goal of a PHB is to provide a specified amount of network resources to a class of traffic on the contiguous network. You can achieve this goal in the QoS policy. Define DSCPs that indicate the precedence levels for traffic classes when the traffic flows leave the IPQoS-enabled system. Precedences can range from high-precedence/low-drop probability to low-precedence/high-drop probability.
For example, your QoS policy can assign to one class of traffic a DSCP that guarantees a low-drop PHB. This traffic class then receives a low-drop precedence PHB from any Diffserv-aware router, which guarantees bandwidth to packets of this class. You can add to the QoS policy other DSCPs that assign varying levels of precedence to other traffic classes. The lower-precedence packets are given bandwidth by Diffserv systems in agreement with the priorities that are indicated in the packets' DSCPs.
IPQoS supports two types of forwarding behaviors, which are defined in the Diffserv architecture, expedited forwarding and assured forwarding.
The expedited forwarding (EF) per-hop behavior assures that any traffic class with EFs related DSCP is given highest priority. Traffic with an EF DSCP is not queued. EF provides low loss, latency, and jitter. The recommended DSCP for EF is 101110. A packet that is marked with 101110 receives guaranteed low-drop precedence as the packet traverses Diffserv-aware networks en route to its destination. Use the EF DSCP when assigning priority to customers or applications with a premium SLA.
The assured forwarding (AF) per-hop behavior provides four different forwarding classes that you can assign to a packet. Every forwarding class provides three drop precedences, as shown in Table 37–2.
The various AF codepoints provide the ability to assign different levels of service to customers and applications. In the QoS policy, you can prioritize traffic and services on your network when you plan the QoS policy. You can then assign different AF levels to the prioritized traffic.
The following figure shows part of an intranet at a company with a partially Diffserv-enabled environment. In this scenario, all hosts on networks 10.10.0.0 and 10.14.0.0 are IPQoS enabled, and the local routers on both networks are Diffserv aware. However, the interim networks are not configured for Diffserv.
The next steps trace the flow of the packet that is shown in this figure. The steps begin with the progress of a packet that originates at host ipqos1. The steps then continue through several hops to host ipqos2.
The user on ipqos1 runs the ftp command to access host ipqos2, which is three hops away.
ipqos1 applies its QoS policy to the resulting packet flow. ipqos1 then successfully classifies the ftp traffic.
The system administrator has created a class for all outgoing ftp traffic that originates on the local network 10.10.0.0. Traffic for the ftp class is assigned the AF22 per-hop behavior: class two, medium-drop precedence. A traffic flow rate of 2Mb/sec is configured for the ftp class.
ipqos-1 meters the ftp flow to determine if the flow exceeds the committed rate of 2 Mbit/sec.
The marker on ipqos1 marks the DS fields in the outgoing ftp packets with the 010100 DSCP, corresponding to the AF22 PHB.
The router diffrouter1 receives the ftp packets. diffrouter1 then checks the DSCP. If diffrouter1 is congested, packets that are marked with AF22 are dropped.
ftp traffic is forwarded to the next hop in agreement with the per-hop behavior that is configured for AF22 in diffrouter1's files.
The ftp traffic traverses network 10.12.0.0 to genrouter, which is not Diffserv aware. As a result, the traffic receives “best-effort” forwarding behavior.
genrouter passes the ftp traffic to network 10.13.0.0, where the traffic is received by diffrouter2.
diffrouter2 is Diffserv aware. Therefore, the router forwards the ftp packets to the network in agreement with the PHB that is defined in the router policy for AF22 packets.
ipqos2 receives the ftp traffic. ipqos2 then prompts the user on ipqos1 for a user name and password.