 In the contention-free period there is no contention between wireless stations con- nected to the same WiFi AP. In this period, TXOP is also given; however, its start time and duration are specified by a hybrid coordinator (HC), which uses QoS polling of wireless stations. Overall, similar to the dominant use of DCF (and not PCF) in WiFi networks, HCCA is rarely used, while the QoS provisioning in WiFi is typically implemented via EDCA. However, to have end-to-end QoS requires mapping of WiFi ACs and priorities onto network classes of wired IP networks, such as IETF DiffServ classes (Table 5.7) [9]. Using the QoS in WiFi and mapping the WiFi priorities onto DSCP values in the IP packer header also has potential security concerns. For example, it is possible for a device connected to a QoS-enabled WiFi network (which does QoS mapping from layer 2 to DSCP on layer 3) to mark packets in a way that degrades existing QoS poli- cies in that network. For example, if gaming applications are set to WiFi user priority 6 (according to Table 5.7) and if such traffic traverses through an enterprise, it may interfere with the business's QoS policies which (for example) intend to provide that priority to business voice service. To avoid such cases requires setting a traffic condi- tioning policy which reflects business objectives and policy, SO that traffic from autho- rized users and applications only will be accepted by the network, while in all other cases (e.g. unauthorized devices) IP packets will be "bleached" (i.e. re-marked for DSCP, e.g. to 0). Such an approach for the QoS policy in WiFi networks is especially relevant for IoT deployments because in such case many devices (globally it is tens of billions devices) are being connected to IP networks with little or no security capabilities, SO such IoT devices are vulnerable (e.g. they can be used for distributed denial of service [DDoS] attacks). Table 5.7 IETF DiffServ classes mapping to WiFi access categories and priorities. WiFi user WiFi access DiffServ class priori