Yeah, unfortunately, as seen by ip_conntrack file the traffic is already ESTABLISHED. I am developing a script to monitor ESTABLISHED hosts and disconnect ones with a particular behavior.