UDP attack on conntracker with spoofed source IP

Description

By default docker has this IP table rule

-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

As I understand it needs conntracker to work.

Using this tool https://github.com/Akupintarbanget/Brute/blob/main/brute.py#L70
attackers can send thousands of spoofed UDP packets with unique fake source IP address on each packet.
This way conntracker starts filling up. And doesn't matter how much it's filled it using plenty of CPU. Having 4 NIC queues and each of their CPU being used at 100% legit packet drop appears.

Reproduce

1. Install docker
2. Run this tool https://github.com/Akupintarbanget/Brute/blob/main/brute.py#L70
3. Connection tracker will start filling up and use too much CPU
   

Expected behavior

Maybe accept UDP packets without conntracker? (Because conntracker creating connections is CPU expensive?)
Something like:

iptables -I DOCKER-USER -p udp -j ACCEPT

P.s. I've tried this and it didn't worked.

docker version

Client:
 Version:           20.10.12
 API version:       1.41
 Go version:        go1.17.3
 Git commit:        20.10.12-0ubuntu4
 Built:             Mon Mar  7 17:10:06 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.12
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.17.3
  Git commit:       20.10.12-0ubuntu4
  Built:            Mon Mar  7 15:57:50 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.5.9-0ubuntu3.1
  GitCommit:        
 runc:
  Version:          1.1.0-0ubuntu1.1
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:

docker info

Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 2
  Running: 0
  Paused: 0
  Stopped: 2
 Images: 2
 Server Version: 20.10.12
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 
 runc version: 
 init version: 
 Security Options:
  apparmor
  seccomp
   Profile: default
  cgroupns
 Kernel Version: 5.15.0-58-generic
 Operating System: Linux Mint 21.1
 OSType: linux
 Architecture: x86_64
 CPUs: 12
 Total Memory: 13.51GiB
 Name: apple
 ID: S44E:EAPQ:7PTT:VIKU:DV6H:6PPA:REGR:X4F4:YENL:D2UT:SDE2:5IPC
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Additional Info

No response

The report names no Moby source file or test. Start by reproducing the behavior with the linked brute.py tool, then inspect the Docker-generated iptables rules and conntrack behavior under spoofed UDP traffic. Done would require a confirmed, maintainable mitigation with regression coverage or documented scope.