If CAP_NET_RAW is granted, we can use raw IP sockets and skip state tracking altogether for any protocol.