I'm new to QoS, but I've been doing some reading and packet captures to learn. From what I can tell (from a sniffer) my phones mark SIP signalling as Type of Service 0x68 and the RTP voice as 0xb8.
But when reading other documents about best practices, I often see references to Class of Service 3 for signalling and Class of Service 5 for RTP. And then I've also seen references to diffserv codepoint 40 vs diffserv codepoint 46.
How do these all relate? Any intro links/articles would be appreciated too.
COS is only a three-bit value while DSCP is a superset extending it to a six-bit value.
You are seeing a hexadecimal representation of the byte field in Wireshark. What you are seeing elsewhere are decimal representations (e.g. 46 of the first six bits of that byte field.
This document includes a table that shows the commonly used binary, decimal, and AF values matched up: http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a00800949f2.shtml