Monitoring QoS with TCPDUMP

To monitor the AF31 class you could use the following filter:

tcpdump -i eth0 -nn ip[1]=0x68

This command will show allĀ  AF31 traffic. For other classes:

AF11 = '001010', AF12 = '001100', AF13 = '001110', AF21 = '010010', 
AF22 = '010100', AF23 = '010110', AF31 = '011010', AF32 = '011100', 
AF33 = '011110', AF41 = '100010', AF42 = '100100', AF43 = '100110'.