Cisco IOS QoS prioritize SSH but not SCP

You can use packet lengths to distinguish one from the other, but there's a risk that these will be chopped and mixed by the SSH transport.

class-map match-all ssh-interactive
 match access-group name ssh
 match packet length max 600
class-map match-all ssh-files
 match access-group name ssh
 match packet length min 600 
ip access-list extended ssh
 permit tcp any any eq 22
 permit tcp any eq 22 any

The cut-off point is arbitrarily picked out of this air, you'd have to tune and see what works for you.


Most (all? OpenSSH at least) SSH implementations set different IP TOS flags depending on if the session is interactive or bulk data. It sets the lowdelay TOS flag for interactive sessions.

You can then match on the TOS flags in your ACL.