| filter hme0 fast_class 0 0 0 53 17 # dns UDP queries | filter hme0 fast_class 0 0 0 53 6 # dns TCP queries I think that should be: filter hme0 fast_class 0 53 0 0 17 filter hme0 fast_class 0 53 0 0 9 as its <dst_addr> <dport> <src_addr> <sport> <proto> -- Sebastian Prause