8. Quality of Service and Traffic Engineering

Introduction and Context

The Internet was originally designed as a best-effort packet network. Routers forward packets when resources are available, but the network does not inherently promise a particular delay, loss rate, bandwidth, or variation in delay. This model is adequate for many elastic applications, such as web browsing, email, software updates, and file transfer. It becomes inadequate when several traffic classes share constrained links and applications have different service requirements.

Voice requires low delay and low jitter; interactive video is sensitive to delay, loss, and throughput; industrial control may require bounded latency and extremely high reliability; and bulk backup traffic can tolerate delay provided that sufficient average bandwidth is eventually obtained. Quality of Service (QoS) provides mechanisms for differentiating and managing such traffic. Traffic engineering (TE) complements QoS by selecting paths and allocating network resources so that traffic flows meet operational and service-level objectives.

QoS is not a single protocol or device feature. It is a coordinated set of classification, marking, policing, shaping, queue-management, scheduling, admission-control, and monitoring functions. Traffic engineering operates at a broader level, using routing, tunnels, labels, segment lists, and resource information to influence where traffic travels. Together, they transform a best-effort infrastructure into a network capable of predictable service differentiation.

Learning Objectives

After completing this chapter, the reader should be able to:

1. Explain bandwidth, delay, jitter, loss, reliability, and service-level objectives as QoS dimensions.

2. Distinguish classification, marking, policing, shaping, scheduling, and admission control.

3. Compare Integrated Services and Differentiated Services architectures.

4. Explain queue-management and scheduling algorithms, including their trade-offs.

5. Describe MPLS traffic engineering and segment routing.

6. Relate deterministic networking to bounded latency and industrial applications.

7. Design a QoS policy for a multi-service enterprise or provider network.

8. Evaluate operational, security, governance, and implementation risks.

Service Requirements as Engineering Constraints

A QoS design begins with applications rather than queues. An application’s requirements should be translated into measurable service-level objectives (SLOs). Typical metrics include:

• Bandwidth or throughput: the rate at which useful data must be delivered.
• One-way delay: the time taken for a packet to travel from source to destination.
• Jitter: variation in packet delay, often important for real-time media.
• Packet loss: packets discarded because of congestion, errors, or policy.
• Availability: the proportion of time that service remains usable.
• Burst tolerance: the amount and duration of traffic variation that can be accepted.
• Reliability: the probability that traffic is delivered correctly and within the required constraints.

A useful conceptual decomposition of delay is

`D_total = D_processing + D_queuing + D_transmission + D_propagation`.

Processing and propagation delay are often relatively stable, whereas queuing delay changes sharply with congestion. QoS mechanisms primarily control queuing behavior and resource allocation. They cannot eliminate physical propagation delay or create bandwidth that does not exist.

Traffic requirements should therefore be stated precisely. “High priority” is weaker than “99.9 percent of packets must experience less than 20 ms one-way delay, with loss below 0.1 percent.” The latter can be measured, monitored, and mapped to a technical policy. In practice, service-level agreements may specify committed information rate, peak rate, latency objectives, loss thresholds, and treatment during congestion.

The QoS Policy Pipeline

A router generally applies QoS through a sequence of related functions. The exact order varies by platform, but the conceptual pipeline is stable.

Classification and Marking

Classification identifies traffic according to fields such as source and destination address, protocol, application port, virtual network, user identity, input interface, or deep packet inspection results. Modern systems may also classify flows using application recognition or telemetry-derived policies. Classification should be as close as possible to the traffic source, where application or organizational context is known.

Marking writes a traffic-class indicator into a packet. In IP networks, the Differentiated Services Code Point (DSCP) occupies six bits in the IP header. Ethernet networks may use IEEE 802.1p priority bits in the VLAN tag. MPLS networks use the Traffic Class field. Marking separates the decision about what traffic is from the later decision about how that traffic is treated.

A sound marking policy uses a small, documented set of classes. Excessive classes increase configuration complexity and make end-to-end behavior difficult to verify. Trust boundaries are essential: an enterprise may trust markings from managed voice endpoints but rewrite markings received from an untrusted customer or public network.

Policing and Shaping

Policing measures traffic against a configured rate and takes immediate action when traffic exceeds the permitted profile. Actions may include dropping packets, remarking them to a lower class, or recording a violation. A token-bucket model is commonly used. Tokens are generated at rate `r` up to a bucket capacity `B`; a packet of size `L` can be transmitted under the profile when at least `L` tokens are available. The bucket allows controlled bursts while enforcing a long-term average rate.

Shaping also regulates traffic, but instead of discarding excess packets immediately, it stores them in a queue and releases them at the configured rate. Shaping is therefore normally applied on an egress interface and requires buffering. It reduces burstiness presented to a downstream link, but it introduces delay and can produce buffer overflow if the offered load remains excessive.

The choice is architectural. Policing is appropriate at a trust or subscription boundary where the network must enforce a contract. Shaping is useful before a slower access link or at a branch router where smoothing bursts is preferable to loss. Neither mechanism solves sustained overload; if the average offered rate exceeds capacity, packets must ultimately be delayed, discarded, or redirected.

Scheduling and Queue Service

When multiple queues compete for an interface, the scheduler determines which packet is transmitted next. First-in, first-out (FIFO) is simple but provides no differentiation. Strict priority always serves the highest-priority nonempty queue first. It is effective for small, delay-sensitive traffic, but an uncontrolled priority class can starve other traffic.

Weighted Fair Queuing (WFQ) approximates fair sharing among flows by assigning service according to weights. Class-Based Weighted Fair Queuing (CBWFQ) applies weights to administratively defined classes and is useful for allocating minimum bandwidth. A priority queue is often combined with weighted classes in a Low-Latency Queuing design. The priority queue must be policed or carefully bounded; otherwise, its advantage becomes a threat to overall fairness.

Deficit Round Robin (DRR) and related round-robin methods are computationally efficient for variable-size packets. Each queue receives a quantum, and a deficit counter permits a queue to transmit packets whose sizes are supported by its accumulated service credit. Scheduling is a resource-allocation decision, not merely a configuration detail. A policy that gives a class a percentage of bandwidth must also consider packet size, bursts, queue limits, and the behavior of downstream devices.

Queue Management and Congestion Avoidance

Tail drop discards packets only when a queue is full. It is easy to implement but can cause global synchronization, high latency, and bursty loss. Active Queue Management (AQM) begins dropping or marking packets before the queue reaches capacity. Random Early Detection (RED) uses an average queue length and probabilistic marking; its performance depends heavily on parameter tuning.

Controlled Delay (CoDel) focuses on persistent sojourn time—the time packets spend in the queue—rather than queue size alone. It attempts to control bufferbloat while preserving high link utilization. PIE (Proportional Integral controller Enhanced) uses a control system to estimate and regulate queuing delay. Explicit Congestion Notification (ECN) allows a congested router to mark packets instead of dropping them, provided that endpoints and transport protocols respond correctly.

AQM is not a substitute for scheduling. Scheduling decides which queue receives service; AQM decides when congestion should be signaled or packets removed. Together they can maintain usable latency under load. Incorrectly tuned thresholds, excessive buffers, or nonresponsive traffic can still defeat the design.

Integrated Services and Differentiated Services

Integrated Services (IntServ) attempts to provide per-flow resource reservation. The Resource Reservation Protocol (RSVP) allows receivers or applications to request resources along a path. Routers maintain flow-specific state and perform admission control. IntServ can express strong requirements, such as a guaranteed service or controlled-load service, but state and signaling grow with the number of flows. This makes large-scale deployment operationally demanding.

Differentiated Services (DiffServ) aggregates traffic into a limited number of behavior aggregates. Packets are marked with DSCP, and each router applies a Per-Hop Behavior (PHB). The network core need not maintain a separate reservation for every flow. Common conceptual PHBs include expedited forwarding for low-loss, low-latency traffic; assured forwarding classes with different drop precedences; and a default best-effort class.

IntServ offers fine-grained reservation but has scalability costs. DiffServ scales better because classification and policy are aggregated, but it generally provides relative treatment rather than an automatic end-to-end guarantee. A provider may combine them: applications use reservation at an edge, while the provider core implements aggregated classes.

Admission Control and Capacity Planning

Admission control determines whether a new flow, customer, tunnel, or service request can be accepted without violating existing commitments. It may consider link capacity, reserved bandwidth, queue limits, path constraints, failure scenarios, and traffic forecasts. A simple utilization threshold is not sufficient because bursts and class interactions matter.

For example, a network may reserve bandwidth for voice and control traffic while allowing data applications to use the remainder. If the reserved class is already near its engineered limit, a new voice session should be rejected, downgraded, or redirected rather than admitted and allowed to degrade all active sessions.

Admission control can be centralized, distributed through signaling, or policy-based. It must be coordinated with routing and failover. A path that is feasible during normal operation may be infeasible after a link failure. Consequently, capacity planning should evaluate failure states, not merely the average topology. Measurement-based admission can use telemetry, while deterministic systems may use formal schedules and explicit resource reservations.

Traffic Engineering: From Routing to Resource-Aware Paths

Conventional IP routing usually selects a shortest path according to a scalar metric. This can leave some links congested while parallel links remain underused. Traffic engineering influences path selection to achieve objectives such as load balancing, latency reduction, resilience, bandwidth reservation, or avoidance of administrative regions.

MPLS Traffic Engineering

Multiprotocol Label Switching (MPLS) forwards packets using labels and can establish Label Switched Paths (LSPs). An ingress router classifies traffic and places it into an LSP; intermediate routers forward according to labels rather than performing an independent destination lookup for every packet. RSVP-TE can signal paths with constraints such as bandwidth, affinities, and explicit routes. Constraint-based routing computes a path that satisfies those constraints.

MPLS TE supports fast reroute, bandwidth-aware tunnels, and separation between service identity and physical forwarding. However, it introduces tunnel-state management, signaling dependencies, and operational complexity. A tunnel may satisfy its bandwidth reservation at setup time but still experience congestion if traffic profiles change or reservations are inaccurate.

Segment Routing

Segment Routing (SR) encodes a path as an ordered list of instructions, called segments. In SR-MPLS, segments are represented by labels; in SRv6, they are represented by IPv6 segment identifiers. The ingress node imposes the segment list, while intermediate nodes execute the associated instructions. This reduces dependence on per-tunnel signaling and can simplify traffic-engineering control.

SR can express a shortest-path segment, a node or adjacency segment, or a service function. A controller or path-computation element may compute a path using topology, latency, bandwidth, and policy information. SR does not automatically guarantee QoS: the network still requires appropriate classification, scheduling, admission control, and monitoring. Its value lies in flexible path steering and programmability.

Deterministic Networking

Deterministic Networking (DetNet) targets bounded latency, bounded loss, and high reliability for applications such as industrial automation, professional media, transportation, and robotics. It extends ordinary QoS by attempting to provide predictable behavior under specified conditions.

Relevant mechanisms include explicit resource allocation, packet replication and elimination for reliability, and traffic shaping at network boundaries. In related time-sensitive networking environments, precise time synchronization, scheduled transmission, and frame-preemption mechanisms can control contention on local links. The key distinction is between statistical performance—“usually low delay”—and a bounded service claim—“delay will remain within a specified limit under the defined traffic and failure model.”

Deterministic services require disciplined engineering. Traffic sources must conform to their profiles; clocks must remain synchronized where schedules depend on time; topology and failure assumptions must be explicit; and admission control must prevent incompatible traffic from entering the system. Deterministic networking is therefore as much a governance and verification problem as a forwarding problem.

An Illustrative Case: QoS and Traffic Engineering for a Distributed University

Background

Consider a university with a central data center, three campuses, cloud services, IP telephony, interactive teaching platforms, research transfers, and administrative applications. The campuses are connected by 1-Gb/s links, but one inter-campus path is occasionally congested during lecture hours and nightly research backups.

Situation and Problem

Users report distorted voice, frozen video, and slow access to administrative systems. Monitoring shows that average link utilization is not continuously high; however, short bursts fill interface buffers. The network currently trusts all DSCP markings, uses FIFO queues, and has no admission policy for high-bandwidth research transfers.

Analysis

The problem is not simply insufficient average bandwidth. Uncontrolled marking allows bulk applications to claim priority. FIFO queues permit backup bursts to create large queuing delays. The absence of traffic engineering causes several flows to use the same shortest path even though an alternate path has available capacity. Voice and interactive teaching have stricter delay requirements than backups, while research transfers require throughput but can tolerate delay.

Approach and Solution

The university first defines four service classes: a bounded and rate-limited priority class for voice and critical control; an interactive class for teaching and collaboration; a business-critical class for administrative applications; and a standard class for backups and general data. Marking is performed at managed access points, and markings from unmanaged sources are rewritten at the trust boundary.

The edge routers police voice and control traffic to a contracted rate and shape selected data classes before the slower inter-campus links. CBWFQ assigns minimum bandwidth to interactive and business-critical classes, while a bounded low-latency queue serves voice. An AQM mechanism with ECN support is enabled for large data queues, and queue limits are reviewed using measured delay rather than buffer capacity alone.

Research-transfer windows are scheduled outside peak teaching periods, and a policy controller can steer large flows through an alternate path using segment routing. Admission control limits simultaneous high-bandwidth transfers. Telemetry records per-class utilization, queue delay, drops, ECN marks, path selection, and SLO violations.

Outcome

The design separates classification from treatment, protects delay-sensitive traffic, and uses the alternate path without requiring every application to understand the physical topology. It does not promise unlimited capacity: when research demand exceeds its allocation, research traffic is delayed or rescheduled. This is preferable to allowing all applications to compete unpredictably.

Learning Points

The case demonstrates that QoS is a system design problem. Marking without trusted boundaries is unsafe; priority without policing is dangerous; shaping without sufficient buffers adds delay; and traffic engineering without accurate demand information can merely move congestion. Measurable objectives and continuous verification are essential.

Implementation Risks and Professional Considerations

A frequent mistake is to create too many classes. Every class must have a clear business purpose, measurable objective, and treatment across the path. Another mistake is to configure QoS only at the network edge. A bottleneck can occur on a provider handoff, wireless link, tunnel, virtual switch, or cloud connection where local policy is absent.

Overprovisioning may be cheaper and simpler than elaborate QoS, particularly when traffic is predictable and capacity is inexpensive. Conversely, QoS is valuable where links are expensive, oversubscription is unavoidable, or service differentiation has contractual significance. Designers should compare the cost of capacity with the complexity and operational risk of policy.

QoS markings can expose organizational or application information and can be abused for preferential treatment. Trust boundaries, authorization, logging, and periodic audits are therefore governance requirements. Privacy rules may limit deep packet inspection. Automated controllers must be constrained by policy, authenticated telemetry, and rollback mechanisms; an erroneous controller decision can redirect large volumes of traffic or create a priority inversion.

Service providers should document whether a class receives absolute guarantees, relative priority, or only a target under stated conditions. Marketing language that implies deterministic performance without specifying traffic profiles, path assumptions, and failure conditions is professionally misleading. Monitoring must distinguish application delay from network delay and must measure both aggregate and per-class behavior.

Contemporary Directions and Best Practices

Modern QoS increasingly depends on streaming telemetry, programmable data planes, intent-based policy, and closed-loop automation. Controllers can combine topology, queue occupancy, flow statistics, and application SLOs to recommend or enact path changes. Machine-learning methods may assist anomaly detection and demand forecasting, but they do not replace deterministic policy, safety limits, or engineering validation.

Cloud and edge computing make end-to-end QoS more difficult because the path crosses administrative and technological domains. Service meshes, virtual network functions, wireless access networks, and encrypted traffic reduce the visibility available to traditional classifiers. Inter-domain agreements and application-level feedback are consequently becoming more important.

A practical best-practice sequence is to identify SLOs, measure the baseline, classify a small number of traffic families, define trust boundaries, select policing and shaping points, allocate queues, engineer paths where necessary, test failure conditions, and continuously verify outcomes. Configuration should be version-controlled, documented, and tested in a representative environment. The design should also specify what happens when resources are unavailable: reject, downgrade, reroute, delay, or drop.

Chapter Summary

QoS provides differentiated and controlled treatment for traffic with different service requirements, while traffic engineering allocates paths and resources to meet those requirements. A complete design translates application SLOs into classification, marking, policing, shaping, scheduling, queue management, admission control, and monitoring policies. IntServ offers per-flow reservation but has scalability challenges; DiffServ aggregates traffic into classes and scales more effectively. AQM controls persistent queuing delay, while scheduling determines how competing queues receive service. MPLS TE and segment routing provide resource-aware path control, but neither guarantees performance without appropriate QoS and admission policies. Deterministic networking extends these principles toward bounded latency and reliability. Effective implementations depend on measurement, trust boundaries, failure-aware capacity planning, governance, and careful automation.

Key Terms

Quality of Service (QoS): Mechanisms for differentiating and controlling network service according to application requirements.

Traffic engineering: Optimization of traffic paths and resource use to satisfy performance and operational objectives.

Service-level objective (SLO): A measurable target for service performance, such as delay, loss, or availability.

Jitter: Variation in packet delay over time.

Classification: Identification of traffic according to packet, flow, application, or policy attributes.

Marking: Writing a class or priority indicator into a packet header.

DSCP: A six-bit IP field used to select differentiated per-hop treatment.

Policing: Enforcing a traffic rate by dropping, remarking, or otherwise acting on excess traffic.

Shaping: Buffering and releasing traffic to conform to a configured rate.

Token bucket: A rate-and-burst model using tokens to represent permitted transmission capacity.

Scheduling: Selecting which queue or class transmits next.

Active Queue Management: Early marking or dropping intended to control congestion and queuing delay.

Admission control: Decision process for accepting new traffic or reservations without violating existing commitments.

IntServ: Per-flow integrated-services architecture based on resource reservation.

DiffServ: Scalable architecture that aggregates traffic into marked service classes.

MPLS: Label-based forwarding technology supporting service and traffic-engineering functions.

Segment routing: Source-directed forwarding using an ordered list of segments or instructions.

Deterministic Networking: Networking approach targeting bounded performance and high reliability under defined conditions.

Review Questions

Short Answer Questions

1. Distinguish one-way delay from jitter.

2. Why is a trust boundary important in DSCP marking?

3. State one difference between policing and shaping.

4. What problem does Active Queue Management address?

5. Why can strict priority scheduling starve other traffic classes?

Long Answer Questions

1. Explain the complete QoS policy pipeline from classification through monitoring.

2. Compare IntServ and DiffServ in terms of reservation granularity, scalability, and guarantees.

3. Explain token-bucket policing and shaping, including their operational trade-offs.

4. Describe how MPLS traffic engineering and segment routing influence path selection.

5. Discuss the engineering requirements for deterministic networking.

Analytical / Application Questions

1. A 100-Mb/s branch link carries voice, interactive video, administrative traffic, and backups. Design a four-class QoS policy and justify the treatment assigned to each class.

2. A priority queue causes excellent voice performance but severe delays for all other traffic. Analyze the likely cause and propose corrective measures.

3. Two equal-cost paths connect a data center to a campus, but one is congested during backups. Explain how admission control, shaping, and segment routing could be combined to improve SLO compliance.

22. Multiple Choice Questions with Answers

Question 1

Which QoS mechanism normally stores excess packets and releases them at a controlled rate rather than immediately discarding them?

A. Policing

B. Shaping

C. Strict priority scheduling

D. Classification

Correct Answer: B. Shaping

Question 2

A network trusts DSCP values from public users, allowing them to select a premium queue. What is the primary design failure?

A. Insufficient propagation bandwidth

B. Missing trust-boundary enforcement

C. Excessive token-bucket size at the receiver

D. Use of ECN instead of RED

Correct Answer: B. Missing trust-boundary enforcement

Question 3

Which statement best describes DiffServ?

A. It maintains a reservation state for every individual flow in the core

B. It aggregates traffic into classes identified by markings and applies per-hop behavior

C. It eliminates the need for admission control in all networks

D. It guarantees identical end-to-end delay for all marked packets

Correct Answer: B. It aggregates traffic into classes identified by markings and applies per-hop behavior

Question 4

Why can an unbounded strict-priority queue harm a network?

A. It prevents high-priority packets from being classified

B. It can starve lower-priority queues

C. It disables all routing protocols

D. It converts shaping into policing

Correct Answer: B. It can starve lower-priority queues

Question 5

Which mechanism primarily attempts to control persistent queueing delay by acting before a buffer becomes completely full?

A. Tail drop only

B. Active Queue Management

C. FIFO forwarding

D. Path propagation

Correct Answer: B. Active Queue Management

Question 6

A new real-time flow is accepted even though all reserved real-time capacity is already committed. Which function was inadequate?

A. Admission control

B. Packet propagation

C. Label swapping

D. Header compression

Correct Answer: A. Admission control

Question 7

What is a principal purpose of MPLS traffic engineering?

A. To replace all application-layer protocols

B. To select label-switched paths subject to resource or policy constraints

C. To guarantee that queues never form

D. To remove the need for packet classification

Correct Answer: B. To select label-switched paths subject to resource or policy constraints

Question 8

How does segment routing primarily support traffic engineering?

A. By encoding an ordered path or set of instructions for the ingress-selected traffic

B. By reserving a separate physical cable for every flow

C. By requiring per-flow RSVP state at every router

D. By disabling shortest-path routing permanently

Correct Answer: A. By encoding an ordered path or set of instructions for the ingress-selected traffic

Question 9

Which statement most accurately distinguishes deterministic networking from ordinary statistical QoS?

A. Deterministic networking seeks bounded performance under defined assumptions

B. Deterministic networking ignores traffic profiles

C. Statistical QoS always provides stronger guarantees

D. Deterministic networking requires FIFO queues only

Correct Answer: A. Deterministic networking seeks bounded performance under defined assumptions

Question 10

In the university case, why were large research transfers scheduled or steered away from peak teaching periods?

A. They required lower reliability than voice

B. They were delay-tolerant and could be managed to reduce contention

C. They could not be classified by any network device

D. They needed strict priority over interactive teaching

Correct Answer: B. They were delay-tolerant and could be managed to reduce contention