[NET]: Avoid unnecessary cloning for ingress filtering