Egress bandwidth limiting not working?

[Sebastian Arcus <shop@open-t.co.uk>]

I am trying to limit the bandwidth used by the egress leg as per the 
lartc cookbook here: 
http://www.lartc.org/howto/lartc.cookbook.ultimate-tc.html

The ingress works fine (well, it is a bit wobbly - but it limits the 
rate at roughly the expected level). However, the egress doesn't appear 
to be working. With no tc active, I get about 300mbs both ways (I'm 
testing in VMs). When it is on, the ingress is down to roughly 500kbs, 
but the egress is down to only about *150mbs*.

Interfaces on both sides use 1500 for MTU. Kernels on both sides are 
3.8.4. Has the syntax changed recently - or is the example at the link 
above incomplete? I appreciate any hints as to what I might be doing wrong.

For the purpose of testing, for egress, I've simplified everything down 
to one root qdisc, one class (to set the rate) and one filter (to catch 
everything):


##############################################
#  egress

# root cbq
tc qdisc add dev eth0 root handle 1: cbq avpkt 1000 \
     bandwidth 1000Mbit

# shape everything at $UPLINK speed - this prevents huge queues in your
# DSL modem which destroy latency:
tc class add dev eth0 parent 1: classid 1:1 cbq rate 500kbit \
     allot 1500 prio 5 bounded isolated

# include everything in the filter
tc filter add dev eth0 protocol ip parent 1:1 prio 3 u32 match \
     ip dst 0.0.0.0/32 flowid 1:1


##############################################
#  ingress

tc qdisc add dev eth0 handle ffff: ingress

tc filter add dev eth0 parent ffff: protocol ip prio 50 u32 \
     match ip src 0.0.0.0/0 police rate 500kbps burst 10k drop flowid :1