@stm110:
Ok, there are some security traffic that really need to come through.
So let´s narrow it down and focus on incoming traffic.
Incoming from the WAN side? You can't control that.
You can only control what leaves the box.
What arrives at the box is decided entirely be the sending side. Furthermore, if what arrives at the box is congesting other traffic arriving at the box, it's just too bad, you can't control that.
Exceptionally, under specific circumstances, there are techniques to limit the sending of TCP ACKs so that the sending side will quench their output, but this is pretty advanced stuff, and I'm not sure the traffic shaper can help with this.
If you're dealing with UDP traffic, all bets are off.
–A.