I updated my scripts to use the 'tc filter ... match ether src/dst' syntax. it really makes reading the script easier. thanks for the tip! however the problem persists. I changed the rule to match ANY pachet of type 802_3 and redirect it to ifb1. but nothing arrives on ifb1. I tried to redirect ARP pachets using 'protocol arp' filter and it works perfectly as expected. so at this point the problem is no longer 'how to match ethernet header' but rather 'how to match a pachet of type 802_3'. My feeling is that there is a bug somewhere in kernel where the 'protocol 802_3' matching happens. I attach part of the script I use to generate the filters and classes. I removed everything related to HTB and IP pachets because there is no problem there. in case the formating is lost, you can download it from here: http://evox.ro/kernel_netdev_tc_protocol_802.3/ Thx for any help, Doru Theodor Petrescu CTO, Evox Solutions SRL http://evox.ro/