A little clarification regarding marks..

Lets say I’m marking packets coming in and going out of my WAN interface. If I use packet marks in Mangle that would mean I’m inspecting and marking every packet individually. So if I use mark connection to do the same thing, that would be more efficient, right?

Second question. I mark the connections coming to the WAN interface as lets say “DOWNstream” and then I mark those “DOWNstream” packets that only come from my FTP server as “FTPdown”. Does it mean these packets coming from my FTP have two marks, “DOWNstream” & “FTPdown”? Or do they lose the first “DOWNstream” mark when I do the “FTPdown” marks?

Another thing, I want to mark all my upload & download traffic. Am I doing this right?

/ip firewall mangle
add chain=forward out-interface=WAN action=mark-packet new-packet-mark=ALL-UpLoad passthrough=yes
add chain=forward in-interface=WAN action=mark-packet new-packet-mark=ALL-DownLoad passthrough=yes

Not sure in what chain I should do this marking. Please help…