The performance overhead of pkt-rules is high

Thank you for your careful consideration. I believe it should be the latter. Such rules still consume a lot of performance.