Thanks Jason. I've tried to organize them here: http://www1.icsi.berkeley.edu/~srikanth/tos.html So please send along any interesting traces, any ideas for tests, or comments! - Srikanth On 11/8/14 9:46 PM, Livingood, Jason wrote:

FYI to this list since I suspect few of you are on the M-Lab Discuss list.

Srikanth from ICSI has kindly taken on consolidating some PCAPs. If anyone wishes to send any to him, he is at srknth.s@gmail.com<mailto:srknth.s@gmail.com>.

JL

On 11/6/14, 7:24 PM, "Srikanth S" <srknth.s@gmail.com<mailto:srknth.s@gmail.com>> wrote: So it looks as though marking is not done for all MLab traffic. Also, some web traffic (to CNN) is marked at a lower priority than streaming (Netflix), which is strange as web traffic is likely more sensitive to degradation than streaming (?).

Here are the traces: http://www1.icsi.berkeley.edu/~srikanth/pcaps/google.pcap http://www1.icsi.berkeley.edu/~srikanth/pcaps/youtube-image.pcap http://www1.icsi.berkeley.edu/~srikanth/pcaps/cnn.pcap http://www1.icsi.berkeley.edu/~srikanth/pcaps/netflix-streaming.pcap

On Tuesday, November 4, 2014 1:29:16 PM UTC-8, Jason Livingood wrote: Another follow-up. Someone emailed me a PCAP off-list from an enterprise type of customer. Their PCAP was somewhat incomplete (so I still need more) but they noticed that some traffic at the next priority down from 0x48 at 0x28 (priority). And some other traffic was marked with the next priority down again at 0x00 (routine).

So it appears there are three DSCP / ToS markings in use rather than just two (0x00, 0x28, 0x48).

So safe to say more research is needed here – anyone collecting PCAPs should IMHO continue. :-)

Jason