What is CoS?

Understanding CoS

CoS (Class of Service) is a Layer 2 mechanism for prioritizing network traffic. It uses a 3-bit Priority Code Point (PCP) field inside the 802.1Q VLAN tag to mark frames with one of eight priority values (0 through 7). Switches use these markings to queue and schedule frames, giving latency-sensitive traffic like voice preferential treatment over best-effort data.

CoS operates only within an Ethernet broadcast domain because the marking lives in the VLAN tag, which is stripped at routed boundaries. As frames cross a network, switches map the PCP value into output queues with different scheduling weights or strict priority. For end-to-end quality across routed hops, CoS is typically translated into the Layer 3 DSCP (Differentiated Services Code Point) field in the IP header, since IP packets retain DSCP across routers while 802.1Q tags do not. Together CoS and DSCP form the marking layer of a broader Quality of Service (QoS) policy that also includes classification, policing, and queuing.

From a security and reliability standpoint, CoS protects the availability of critical applications during congestion and helps resist resource-exhaustion conditions. Without prioritization, a flood, whether a DDoS attack or a backup job, can starve voice and control-plane traffic. However, CoS markings are not trusted by default at network edges: an attacker on an untrusted port could set high-priority values to jump the queue. Best practice is to mark or remark traffic at trusted ingress points and clear or police CoS from user-facing access ports.

For example, in a campus VoIP deployment, IP phones tag voice frames with CoS 5 and DSCP EF (Expedited Forwarding). Access switches trust the phone's markings only via a verified voice VLAN, place CoS 5 frames in a low-latency priority queue, and re-mark any traffic arriving from the attached PC. During a bandwidth spike from a large file transfer, calls stay clear because the priority queue is serviced first, while untrusted PC traffic cannot spoof its way into that queue.