Q:

Which set of commands will limit the outgoing data rate to X kbps for traffic to or from port Y?

I have a Raspberry Pi, and I'd like to have bitcoind running on it. This consumes a lot of my outgoing bandwidth at times, so I'd like to make sure it never uses more than 20 KB/s for Bitcoin data.
The Bitcoin protocol uses port 8333 for connections, so I figure it should be possible to identify connections easily by just looking at if either the source or destination port equals 8333.
On Linux, which set of commands will make sure that data to and from port 8333 will not exceed 20 KB/s?

A:

The following set of commands will limit the outgoing rate for traffic with a source or destination port of 8333 to 160 kbit/s, unless the destination IP is on the local network.
#network interface on which to limit traffic
IF="eth0"
#limit of the network interface in question
LINKCEIL="1gbit"
#limit outbound Bitcoin protocol traffic to this rate
LIMIT="160kbit"

#delete existing rules
tc qdisc del dev ${IF} root

#add root class
tc qdisc add dev ${IF} root handle 1: htb default 10

#add parent class
tc class add dev ${IF} parent 1: classid 1:1 htb rate ${LINKCEIL} ceil ${LINKCEIL}

#add our two classes. one unlimited, another limited
tc class add dev ${IF} parent 1:1 classid 1:10 htb rate ${LINKCEIL} ceil ${LINKCEIL} prio 0
tc class add dev ${IF} parent 1:1 classid 1:11 htb rate ${LIMIT} ceil ${LIMIT} prio 1

#add handles to our classes so packets marked with <x> go into the class with "... handle <x> fw ..."
tc filter add dev ${IF} parent 1: protocol ip prio 1 handle 1 fw classid 1:10
tc filter add dev ${IF} parent 1: protocol ip prio 2 handle 2 fw classid 1:11

#limit outgoing traffic to and from port 8333. but not when dealing with a host on the local network
#   --set-mark marks packages matching these criteria with the number "2"
#   these packages are filtered by the tc filter with "handle 2"
#   this filter sends the packages into the 1:11 class, and this class is limited to ${LIMIT}
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport 8333 ! -d 192.168.0.0/16 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 8333 ! -d 192.168.0.0/16 -j MARK --set-mark 0x2

