CAP_SYS_RAWIO looks even more terrifying, but CAP_NET_RAW gates your ability to use raw sockets.

https://linux.die.net/man/7/capabilities