From my understanding - wireshark is software driven hence the capture and the write process of each packet is done before the markings - that is why when you do a wireshark capture on the device DSCP is set to (0) - the work around for was to mirror the port in question and connect your laptop to the mirrored port and run a capture off your connected device - there you will see the markings at least I did... ... View more