Well, we used to be able to do that with netfilter but it had the
same unfixable race conditions that you are presently running into
and so such support was dropped by the netfilter folks. I suspect if
you CC'ed netdev@vger.kernel.org you would get some very precise
reasons why such filtering doesn't work.
Cheers,
Kyle Moffett
-