[Flow-tools] interpreting ToS field?

[sthaug at nethelp.no]

> Various flow-stat and flow-report output include Type of Service
> reports.  I'm finally on a network where we use ToS, and I need to
> make sense of the results.
> 
> Can anyone point me to any documentation on the ToS values flow-tools
> reports?  How can I map these results to, say, DSCP?  Here's a snippet
> of flow-stat output for reference:

There's no magic here. ToS is the whole 8 bit ToS field. Divide by 4
(or right shift 2) to get DSCP, since DSCP is the 6 most significant
bits of the ToS field.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no