making HTB work...

I am revisiting an issue from a while ago.

http://lists.nocat.net/pipermail/nocat/2003-March/003003.html
http://www.freenetworks.org/pipermail/pebble-linux/2003-August/000291.html

So, it looks like I have HTB behaving properly on my gateway. I am 
running pebble v0.41
HTB should work without rebuilding the kernel.

dmesg shows the following:

usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
uhci.c: USB Universal Host Controller Interface driver v1.1
usb.c: deregistering driver hub
HTB init, kernel part version 3.13
HTB init, kernel part version 3.13

I am using the tc binary from 
http://luxik.cdi.cz/~devik/qos/htb/v3/htb3.6-020525.tgz

I sftp'd the binary into /sbin/tc on the gateway and then

chmod +x /sbin/tc
chmod +s /sbin/tc

I also enabled throttle.fw towards the bottom of initialize.fw

Now, when my gateway runs, I do a dump of  IPTables using

/usr/local/nocat/bin/dump.fw

Here's some output from the mangle table.

 >>>>> Mangle table: <<<<<

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        
NoCat      all  --  0.0.0.0/0            0.0.0.0/0         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
TOS        tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:22 
TOS set 0x10
TOS        tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:80 
TOS set 0x08
TOS        tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:443 
TOS set 0x08

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain NoCat (1 references)
target     prot opt source               destination        
MARK       all  --  0.0.0.0/0            0.0.0.0/0          MARK set 0x4
MARK       all  --  192.168.89.12        0.0.0.0/0          MAC 
00:D0:B7:1C:BE:50 MARK set 0x1
MARK       all  --  0.0.0.0/0            192.168.89.12      MARK set 0x1
MARK       all  --  192.168.89.10        0.0.0.0/0          MAC 
00:02:2D:1B:50:67 MARK set 0x1
MARK       all  --  0.0.0.0/0            192.168.89.10      MARK set 0x1
MARK       all  --  192.168.89.11        0.0.0.0/0          MAC 
00:E0:00:D3:47:13 MARK set 0x3
MARK       all  --  0.0.0.0/0            192.168.89.11      MARK set 0x3

 
Looks like my packets are getting marked. The MARK does indeed change 
based on who I log in as. So far, so good.

Now, my questions:

How do I know that this will actually work? How do I mark packets going 
both in and out, so that throttling happens both ways?
Tests with speakeasy's tool show throttling of data going out (I can 
clamp it down to 56K for public category) but nothing makes it throttle 
for the incoming stream.

Anybody have a clue ?

--
Sameer