For QoS-based trace analysis at the HPWREN-internet perimeter traffic
tracking machine it turned out to be difficult to differentiate
between traffic entering or leaving HPWREN. The easiest solution seemd
to be to set everything heading into HPWREN from the 3825 router to an
otherwise unused DSCP value (1):

  # external traffic coming into HPWREN from SDSC
  # hpwren-internet-router:

  policy-map hpwren-internetsource
   class class-default
    set dscp 1

  interface GigabitEthernet0/0
   service-policy input hpwren-internetsource
  interface GigabitEthernet1/0
   service-policy input hpwren-internetsource

The traffic impact should be negligible, as the connected backbone
router immediately resets the QoS attributes to the proper values
anyway.