I guess it would be way better to do that in userspace. If you really want to do that in kernel, you'd better go ask this in netdev mail list. If your idea is reasonable you'll propably get help - it if is not - well, you'll hear that too. Just do not forget the etiquette when mailing at netdev
in userspace you could propably get packets for filtering using netlink sockets.