If you don't know it yet check out pwru [0] it's an eBPF based tool that let's you trace packets through the kernel using a tcpdump style syntax.

[0]: https://github.com/cilium/pwru