The Fugue

iptables, I'm really disappointed in you. If I'm reading your manpage correctly, and the NAG says that I am, you don't support matching or setting the TOS field (whether as a TOS byte or as the DSCP 6-bit subfield) with a mask. You can only match exact values.

That's just about pretty much useless. And considering that ipchains did let you do masks (although it was a cumbersome and-mask and xor-mask pair), inexcusable. One could use -m u32, but this doesn't seem to be available in OpenWRT. Luckily the goal is to mark packets for QoS, and I can just drop into tc directly to accomplish what I need. So to match any packet with the low delay bit set,

tc filter add dev $DEV parent $PARENT protocol ip u32 \
    match ip tos 0x10 0xff flowid $FLOW