>
    Strata Copilot
    inspect priority-policy hits default-rule-dscp
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Use CLI Commands
    4. Inspect Commands
    5. inspect priority-policy hits default-rule-dscp
    Download PDF
    Prisma SD-WAN

    inspect priority-policy hits default-rule-dscp

    Table of Contents

    inspect priority-policy hits default-rule-dscp

    Use the inspect priority-policy hits default-rule-dscp command to display hit counts for default DSCP priority mappings, showing how much traffic each DSCP value has matched.
    Use the inspect priority-policy hits default-rule-dscp command to verify that the default rule recognizes and maps incoming traffic DSCP markings to the correct priority class. The output shows each DSCP value, whether the default rule maps it to a priority, the traffic type, and cumulative and new hit counts. Use the reset-diff option to zero the New Hits counter, then run diff-only after a period of time to see only the DSCP values that received traffic in that window. This identifies active DSCP markings, detects unmapped values, and confirms that QoS classification is working as expected.

    Command

    inspect priority-policy hits default-rule-dscp ( all | reset-diff | diff-only )

    Options

    allDisplay hit count information for all DSCP values in the default rule.
    reset-diffReset the New Hits counter to zero for all DSCP mappings.
    diff-onlyDisplay only DSCP values where the New Hits count is non-zero. Use after reset-diff to see DSCP values that received traffic since the last reset.

    When to Use

    • When traffic is not receiving the expected QoS priority class and DSCP-based classification is configured, to confirm whether the device is seeing the DSCP marking at all.
    • Before modifying the default rule's DSCP map, to understand which values are actively in use and which have never been observed.
    • When a DSCP marking set by an upstream device is not being honored, to determine whether the marking is arriving on the device or being cleared in transit.

    Command Notes

    RoleSuper, Read Only
    Related Commands
    inspect priority-policy hits policy-rules
    Introduced inRelease 5.0.1

    Example

    The following example displays hit counts for all DSCP mappings in the default rule:
    inspect priority-policy hits default-rule-dscp all
DSCP    Mapped  Priority  Traffic Type  Total Hits  New Hits
------  ------  --------  ------------  ----------  --------
0       Yes     1         rt_audio      175         8
1       Yes     2         rt_audio      58          1
2       Yes     2         rt_video      48          12
3       No      4         --------      0           0
.
.
62
63      Yes     3         bulk          0           0

    Output Fields

    • DSCP: The DSCP value (0–63) being evaluated.
    • Mapped: Whether the default rule maps this DSCP value to a priority class. Yes means the value has an explicit mapping; No means it falls through to the default handling.
    • Priority: The priority class number for this DSCP mapping.
    • Traffic Type: The traffic classification associated with the priority class, such as rt_audio, rt_video, or bulk.
    • Total Hits: The cumulative number of times the default rule has classified traffic with this DSCP value since the last system restart.
    • New Hits: The number of hits since the last reset-diff. Resets to zero when reset-diff runs.

    Troubleshooting

    ConditionPossible CauseAction
    A DSCP value shows Mapped = No but traffic with that value should be classifiedThe default rule's DSCP map does not include this valueUpdate the default rule in the controller to add a mapping for the missing DSCP value
    Total Hits for an expected DSCP value is zero even though traffic with that marking is flowingA specific priority policy rule matches the traffic before it reaches the default rule's DSCP classifierUse inspect priority-policy hits policy-rules to confirm whether a specific rule matches the traffic first
    All traffic is accumulating on DSCP 0Upstream devices are not setting DSCP markings, or transit devices are clearing the markingsInvestigate upstream device QoS marking configuration and any transit devices that may be remarking or clearing DSCP

    © 2026 Palo Alto Networks, Inc. All rights reserved.