We might remove the ICMP movement from the mark. It is very useful when we want to provide good PINGs, regardless of exploit degree for link and individula queues of users.
In this case, one have to add following (terminal) at the beginnig (before others rules at/IP firewall mangle):
The rule above will remove the ICMP movement from the rest of disguise rules.
We also may use a few of another marks for every user, individually set amount of given movement type, which user can operate.However one should remember that a lot of entries number is not necessarily good. All depends on movement generating and computational power of device.
The test device based on the Pentium III 1000MHz processor will be proved useful even by movement of 1000 users ,but on condition we resign many additional functions, (as 'connection tracking' or wide use of firewall) and create almost transparently bandwidth – manger.
At the RouterOS 3.0 system it is possible to use multithreading and theoretically the additional processor should performance redouble, but in practise, I would not raly on that. The strong devices by Intel with one-kernel are the best for the movement forming with MikroTik.