I think I must have the syntax wrong for using the firewall classifier in TCNG. Can anyone offer any suggestions for what I am doing wrong. Details below... #include "packet.def" dev eth0 100000 { htb (rate 128kbps, ceil 150kbps ) { fw; class (0x100) { htb (rate 100kbps, ceil 120kbps ) { class if 1 { sfq(perturb 10secs); } } } class (0x200) { htb (rate 50kbps, ceil 60kbps ) { class if 1 { sfq(perturb 10secs); } } } } } send nfmark=0x100 TCP_PCK() send nfmark=0x200 TCP_PCK() end Invoked with tcsim -v -v -v test3.tcsim. You can see in the resulting simulation run that the packet never makes it to the queues I had intended, namely the sfqs. .000000 T : qdisc add dev eth0 handle 1:0 root htb 0.000000 T : class add dev eth0 parent 1:0 classid 1:100 htb rate 16000bps ceil 18750bps 0.000000 T : qdisc add dev eth0 handle 2:0 parent 1:100 htb 0.000000 T : class add dev eth0 parent 2:0 classid 2:1 htb rate 12500bps ceil 15000bps 0.000000 T : qdisc add dev eth0 handle 3:0 parent 2:1 sfq perturb 10 0.000000 T : filter add dev eth0 parent 2:0 protocol all prio 1 u32 match u32 0x0 0x0 at 0 classid 2:1 0.000000 T : class add dev eth0 parent 1:0 classid 1:200 htb rate 16000bps ceil 18750bps 0.000000 T : qdisc add dev eth0 handle 4:0 parent 1:200 htb 0.000000 T : class add dev eth0 parent 4:0 classid 4:1 htb rate 6250bps ceil 7500bps 0.000000 T : qdisc add dev eth0 handle 5:0 parent 4:1 sfq perturb 10 0.000000 T : filter add dev eth0 parent 4:0 protocol all prio 1 u32 match u32 0x0 0x0 at 0 classid 4:1 0.000000 T : filter add dev eth0 parent 1:0 protocol all prio 1 fw 0.000000 E : 0x80ced10 60 : eth0: 4500003c 00000000 40000000 0a000001 121a006a 45000000 00000000 40060000 0a000001 121a006a 00000000 00000000 00000000 50000000 00000000 0.000000 e : 0x80ced10 60 : <0> calling htb (1:0) 0.000000 c : 0x80ced10 60 : <1> calling fw at 1:0, prio 0x00010000 0.000000 c : 0x80ced10 60 : <1> fw at 1:0 returns OK (0) (0:100, 0x0) 0.000000 e : 0x80ced10 60 : <0> htb (1:0) returns SUCCESS (0) 0.000000 d : 0x0 0 : <0> calling htb (1:0) 0.000000 d : 0x80ced10 60 : <0> htb (1:0) 0.000000 D : 0x80ced10 60 : eth0: 4500003c 00000000 40000000 0a000001 121a006a 45000000 00000000 40060000 0a000001 121a006a 00000000 00000000 00000000 50000000 00000000 0.000000 E : 0x80cf088 60 : eth0: 4500003c 00000000 40060000 0a000001 121a006b 45000000 00000000 40060000 0a000001 121a006b 00000000 00000000 00000000 50000000 00000000 0.000000 e : 0x80cf088 60 : <0> calling htb (1:0) 0.000000 c : 0x80cf088 60 : <1> calling fw at 1:0, prio 0x00010000 0.000000 c : 0x80cf088 60 : <1> fw at 1:0 returns OK (0) (0:200, 0x0) 0.000000 e : 0x80cf088 60 : <0> htb (1:0) returns SUCCESS (0) 0.000005 d : 0x0 0 : <0> calling htb (1:0) 0.000005 d : 0x80cf088 60 : <0> htb (1:0) 0.000005 D : 0x80cf088 60 : eth0: 4500003c 00000000 40060000 0a000001 121a006b 45000000 00000000 40060000 0a000001 121a006b 00000000 00000000 00000000 50000000 00000000 0.000010 d : 0x0 0 : <0> calling htb (1:0) 0.000010 d : 0x0 0 : <0> htb (1:0) 0.000010 d : 0x0 0 : <0> calling htb (1:0) 0.000010 d : 0x0 0 : <0> htb (1:0) 1.000000 d : 0x0 0 : <0> calling htb (1:0) 1.000000 d : 0x0 0 : <0> htb (1:0) 1.000000 d : 0x0 0 : <0> calling htb (1:0) 1.000000 d : 0x0 0 : <0> htb (1:0) 1.000000 d : 0x0 0 : <0> calling htb (1:0) 1.000000 d : 0x0 0 : <0> htb (1:0) 10.000000 d : 0x0 0 : <0> calling htb (1:0) 10.000000 d : 0x0 0 : <0> htb (1:0) 10.000000 d : 0x0 0 : <0> calling htb (1:0) 10.000000 d : 0x0 0 : <0> htb (1:0) 3600.000000 d : 0x0 0 : <0> calling htb (1:0) 3600.000000 d : 0x0 0 : <0> htb (1:0)