I have found that IPMARK isn''t working quite as expected due to the fact, previously unknown to me, that tc class Ids are always assumed to be represented in hex! So what you see in the output of ''shorewall show tc'' as 1:110 is actually 1:266 in decimal. This is going to require some work to resolve -- not before 4.3.10, I''m guessing. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Stay on top of everything new and different, both inside and around Java (TM) technology - register by April 22, and save $200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco. 300 plus technical and hands-on sessions. Register today. Use priority code J9JMT32. http://p.sf.net/sfu/p