QoS · Topic 1 of 3

Layer 2 QoS with 802.1p and Bridge Filter Priority

Learn how 802.1p priority bits mark Layer 2 traffic, and how a RouterOS bridge filter can set or keep the priority of frames passing through the bridge.

  • 4 min
In a nutshell
  • 802.1p uses the three PCP bits in the 802.1Q tag, giving values 0 to 7.
  • Untagged frames carry no PCP, so the priority is lost.
  • A higher PCP value means a higher priority, and 0 is the default.

What it is

802.1p is the Layer 2 way to mark frames with a priority, so that busy links serve important traffic first.

The priority sits in the three PCP bits of the 802.1Q VLAN tag. It gives eight classes, from 0 to 7. Switches and routers along the path can read the value and queue the frames accordingly.

IP phonemarks priority 5tagged frameSwitchreads PCP, queues firsttrunkRouterkeeps priority

Priority does not create bandwidth. It only decides who waits when a link is full.

How it works

A frame carries a priority, and each device decides whether to trust it, change it or keep it.

The PCP field

The PCP field is part of the VLAN tag.

PCPTypical use
7 and 6Network control
5Voice
4Video
3 to 1Business data and background traffic
0Best effort, the default

The mapping of values to traffic types is a convention. What matters is that all devices on the path apply the same meaning.

A frame with no VLAN tag has no PCP field, so the priority cannot travel in it. A tag with VLAN ID 0 can carry the priority alone.

Priority inside RouterOS

RouterOS keeps a priority value for every packet while it is processing it.

The value comes from the tag when a tagged frame arrives, and it can be changed by rules. When the packet leaves through a VLAN interface, the current priority is written into the tag. This is how the value reaches the next device.

Setting priority with a bridge filter

A bridge filter rule can read the priority of a frame and change it.

/interface bridge filter add chain=forward in-interface=ether2 action=set-priority new-priority=5

This rule sets priority 5 on all frames that enter through ether2 and pass through the bridge. Another way is to copy the value from the incoming frame:

/interface bridge filter add chain=forward action=set-priority new-priority=from-ingress

The ingress-priority match can select frames that arrive with a certain priority. A rule can for example lower the priority of tagged frames from untrusted ports.

/interface bridge filter add chain=forward in-interface=ether5 ingress-priority=7 action=set-priority new-priority=0
Watch out

Bridge filter rules are handled by the CPU. Adding them to a bridge can stop hardware offload for the traffic they touch.

Trust and re-marking

You choose per port how far to trust the sender.

  • Trust: keep the priority that arrives. Use it on trunks to other switches that you control.
  • Re-mark: overwrite it with a value that you choose. Use it on user ports.
  • Reset: set it to 0 for traffic that should never get special treatment.

A user device that marks everything as priority 7 would otherwise get the best service. Re-marking on the ingress port prevents that.

Priority and queues

A priority value has an effect only where a queue acts on it.

On a CPU switched path, queues can use the priority to decide order. On a switch chip, the chip maps the priority to its own hardware queues. The next page covers that side.

Checking the result

/interface bridge filter print
/interface bridge filter print stats

The counters show how many frames each rule has matched. If a counter stays at zero, the traffic does not reach the rule, because of the chain, the interface or the offload.

Exam tip

Mark priority as close to the source as you can, at the ingress port, and trust it on the links between your own switches.

Limits of bridge filter priority

It works only for frames the CPU sees.

Frames switched wholly in hardware never reach the bridge filter. On a chip with hardware offload you must use the chip's own QoS features instead.

What to remember for the exam

Seven facts cover most questions on this topic.

  • 802.1p uses the three PCP bits in the 802.1Q tag, giving values 0 to 7.
  • Untagged frames carry no PCP, so the priority is lost.
  • A higher PCP value means a higher priority, and 0 is the default.
  • action=set-priority in a bridge filter changes the packet priority.
  • new-priority=from-ingress keeps the priority from the incoming frame.
  • A VLAN interface writes the packet priority into the tag on egress.
  • Bridge filter rules run on the CPU and can disable hardware offload.

Common mistakes

These four mistakes appear often.

Trusting user ports. Users can mark everything as high priority and take the best service.

Expecting priority on untagged traffic. Without a tag there is no PCP field to carry it.

Marking on one device only. Every device on the path must honour the same values.

Using a bridge filter on an offloaded bridge. The rule may disable offload, and slow the device.

Check yourself

Work through these three questions.

  • Where is the 802.1p priority stored in a frame?

    In the three PCP bits of the 802.1Q VLAN tag, giving values 0 to 7.

  • Which action changes the priority in a bridge filter rule?

    action=set-priority with a new-priority value.

  • Why should user ports be re-marked?

    Otherwise a user could mark all traffic as high priority and take the best service.

Topic 1 of 3 in QoS

Test yourself on QoS

The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.