Distinguish nntp download from upload

[Tong <mlist4suntong@yahoo.com>]

Hi,

Is there any way to distinguish nntp download from upload?

I'm using WonderShaper[1] to do traffic shaping. But apparently it is not
good enough to distinguish nntp download from upload. When I'm posting, my
nntp download speed will drop to around half of full speed. 

Basically I'm using the following two rules to control nntp download &
upload:

iptables -t mangle -A MYSHAPER-OUT -p tcp --dport nntp -j MARK --set-mark 25     # newsgroup download, low prio
iptables -t mangle -A MYSHAPER-OUT -p tcp -m length --length :64 -j MARK --set-mark 21 # small packets (probably just ACKs)

I.e., I hope the nntp download request should be small enough to fall into
the class 21 category. But apparently it is not. Anybody knows a fix?

Thanks a lot!

PS, 

[1] about Wonder Shaper:

The Wonder Shaper
http://lartc.org/wondershaper/

Wonder Shaper How To
http://ccfaq.valar.co.uk/modules.php?name=News&file=article&sid=209

Wonder Shaper QOS-init scripts
http://dolly.czi.cz/coyote/qos_init.asp?id=wonder