I'm finally going to break down and ask for help.

This started out as a wondershaper.htb file, and has most of the wshaper still in place. Because of the way the pattern matching works, I default the traffic to the "slow" bucket, and am trying to move the desirable (http, ftp, smtp, etc) traffic to the "medium" bucket while leaving the undesireable (limewire, edonkey, etc) traffic in the "slow" bucket.

Using tc filters to traffic shape, I am trying to place packets with source and/or destination ports less than 1024 into the "medium speed" bucket.

tc filter add dev $DEV2 protocol ip parent 1: prio 20 u32 match u16 0x0000 0xfc00 at nexthdr+0 flowid 1:21
tc filter add dev $DEV2 protocol ip parent 1: prio 20 u32 match u32 00000000 0000fc00 at nexthdr+0 flowid 1:21


This does not work, since I can tell that http traffic does not get moved until I add the following lines.

tc filter add dev $DEV2 protocol ip parent 1: prio 20 u32 match ip dport 80 0xffff flowid 1:21
tc filter add dev $DEV2 protocol ip parent 1: prio 20 u32 match ip sport 80 0xffff flowid 1:21

The addition of these two filter lines moves 80% of the traffic out of the "slow" bucket into the "medium" bucket. Without the two lines, about 5% traffic is in the " fast bucket" and 5-10% is in the "medium" bucket.

Do I misunderstand this, or just have a minor mistake somewhere? The LARTC has gotten me this far, but something is just not clicking.

Thanks in advance.