For QoS-based trace analysis at the HPWREN-internet perimeter trffic 
tracking machine it turned out to be difficult to differentiate 
between traffic entering or leaving HPWREN. The easiest solution seemd
to be to set everything heading into HPWREN from the 3825 router to an
otherwise unused DSCP value (1):
 
  # external traffic coming into HPWREN from SDSC
  # hpwren-internet-router:
 
  policy-map hpwren-internetsource
   class class-default
    set dscp 1
  
  interface GigabitEthernet0/0
   service-policy input hpwren-internetsource
  interface GigabitEthernet1/0
   service-policy input hpwren-internetsource
 
The traffic impact should be negligible, as the connected backbone    
router immediately resets the QoS attributes to the proper values 
anyway.