{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "item": { "id": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "slug": "classify-pfsense-dscp-traffic-from-the-connection-s-first-packet", "url": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet.md", "json": "https://update.dsesecurity.com/api/v1/posts/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/" }, "title": "Classify pfSense DSCP traffic from the connection's first packet", "summary": "A mark applied only after connection establishment may not influence the expected stateful classification.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:25+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 258, "potentially_affected": "This concerns the documented pfSense DiffServ matching behavior.", "dse_recommendation": "DSE recommends checking endpoint marking at connection establishment before changing firewall classification rules.", "primary_source": { "name": "Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers", "url": "https://docs.netgate.com/pfsense/en/latest/trafficshaper/dscp.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A mark applied only after connection establishment may not influence the expected stateful classification.

\n

Source facts

\n

Netgate states that pfSense matches DSCP values but does not set or change them through this feature. Matching is exact across the six-bit field. With normal state handling, classification normally uses the packet creating the state, so a later mark change or a differently marked first packet can produce an unexpected queue assignment.

\n

Source: Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers.

\n

Applicability

\n

This concerns the documented pfSense DiffServ matching behavior.

\n

DSE recommendation

\n

DSE recommends checking endpoint marking at connection establishment before changing firewall classification rules. Align the rule with the exact expected DSCP value and document which device owns marking. Avoid a no-state workaround merely to chase changing marks; the source warns that securely constructing such rules is difficult. Keep Layer 2 PCP and Layer 3 DSCP policies distinct even when they represent the same business traffic class. Include the initial packet in the endpoint evidence, rather than beginning capture after the conversation is underway. Ask the application owner to identify the intended marker at connection start. Compare a fresh correctly marked flow with the problematic flow before rewriting queue or firewall policy.

\n

Verification

\n

Capture a fresh approved connection from its first packet and compare DSCP values over its lifetime. Inspect the matched rule and queue for that connection. Repeat with an unmarked control flow and confirm that both classifications match the intended policy before drawing conclusions from aggregate interface throughput.

\n

Official reference

\n

Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers. Reviewed October 20, 2026.

", "content_text": "A mark applied only after connection establishment may not influence the expected stateful classification.\nSource facts\nNetgate states that pfSense matches DSCP values but does not set or change them through this feature. Matching is exact across the six-bit field. With normal state handling, classification normally uses the packet creating the state, so a later mark change or a differently marked first packet can produce an unexpected queue assignment.\nSource: Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers.\nApplicability\nThis concerns the documented pfSense DiffServ matching behavior.\nDSE recommendation\nDSE recommends checking endpoint marking at connection establishment before changing firewall classification rules. Align the rule with the exact expected DSCP value and document which device owns marking. Avoid a no-state workaround merely to chase changing marks; the source warns that securely constructing such rules is difficult. Keep Layer 2 PCP and Layer 3 DSCP policies distinct even when they represent the same business traffic class. Include the initial packet in the endpoint evidence, rather than beginning capture after the conversation is underway. Ask the application owner to identify the intended marker at connection start. Compare a fresh correctly marked flow with the problematic flow before rewriting queue or firewall policy.\nVerification\nCapture a fresh approved connection from its first packet and compare DSCP values over its lifetime. Inspect the matched rule and queue for that connection. Repeat with an unmarked control flow and confirm that both classifications match the intended policy before drawing conclusions from aggregate interface throughput.\nOfficial reference\nNetgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers. Reviewed October 20, 2026.", "content_markdown": "A mark applied only after connection establishment may not influence the expected stateful classification.\n\n## Source facts\n\nNetgate states that pfSense matches DSCP values but does not set or change them through this feature. Matching is exact across the six-bit field. With normal state handling, classification normally uses the packet creating the state, so a later mark change or a differently marked first packet can produce an unexpected queue assignment.\n\nSource: [Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers](https://docs.netgate.com/pfsense/en/latest/trafficshaper/dscp.html).\n\n## Applicability\n\nThis concerns the documented pfSense DiffServ matching behavior.\n\n## DSE recommendation\n\nDSE recommends checking endpoint marking at connection establishment before changing firewall classification rules. Align the rule with the exact expected DSCP value and document which device owns marking. Avoid a no-state workaround merely to chase changing marks; the source warns that securely constructing such rules is difficult. Keep Layer 2 PCP and Layer 3 DSCP policies distinct even when they represent the same business traffic class. Include the initial packet in the endpoint evidence, rather than beginning capture after the conversation is underway. Ask the application owner to identify the intended marker at connection start. Compare a fresh correctly marked flow with the problematic flow before rewriting queue or firewall policy.\n\n## Verification\n\nCapture a fresh approved connection from its first packet and compare DSCP values over its lifetime. Inspect the matched rule and queue for that connection. Repeat with an unmarked control flow and confirm that both classifications match the intended policy before drawing conclusions from aggregate interface throughput.\n\n## Official reference\n\n[Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers](https://docs.netgate.com/pfsense/en/latest/trafficshaper/dscp.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "url": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Classify pfSense DSCP traffic from the connection's first packet", "item": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/#article", "identifier": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "url": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/", "headline": "Classify pfSense DSCP traffic from the connection's first packet", "description": "A mark applied only after connection establishment may not influence the expected stateful classification.", "abstract": "A mark applied only after connection establishment may not influence the expected stateful classification.", "articleBody": "A mark applied only after connection establishment may not influence the expected stateful classification.\nSource facts\nNetgate states that pfSense matches DSCP values but does not set or change them through this feature. Matching is exact across the six-bit field. With normal state handling, classification normally uses the packet creating the state, so a later mark change or a differently marked first packet can produce an unexpected queue assignment.\nSource: Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers.\nApplicability\nThis concerns the documented pfSense DiffServ matching behavior.\nDSE recommendation\nDSE recommends checking endpoint marking at connection establishment before changing firewall classification rules. Align the rule with the exact expected DSCP value and document which device owns marking. Avoid a no-state workaround merely to chase changing marks; the source warns that securely constructing such rules is difficult. Keep Layer 2 PCP and Layer 3 DSCP policies distinct even when they represent the same business traffic class. Include the initial packet in the endpoint evidence, rather than beginning capture after the conversation is underway. Ask the application owner to identify the intended marker at connection start. Compare a fresh correctly marked flow with the problematic flow before rewriting queue or firewall policy.\nVerification\nCapture a fresh approved connection from its first packet and compare DSCP values over its lifetime. Inspect the matched rule and queue for that connection. Repeat with an unmarked control flow and confirm that both classifications match the intended policy before drawing conclusions from aggregate interface throughput.\nOfficial reference\nNetgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:25+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/classify-pfsense-dscp-traffic-from-the-connection-s-first-packet/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Classify pfSense DSCP traffic from the connection's first packet" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 258, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Traffic Shaping with Differentiated Services (DiffServ) Identifiers", "url": "https://docs.netgate.com/pfsense/en/latest/trafficshaper/dscp.html" } } ] } }