How to mark packets by program

**How to mark all packets (inbound and outbound) for specific program/ cmd in Linux using iptables or any other firewall/ tool** Given that --cmd-owner option was deprecated ref:http://www.spinics.net/lists/netfilter/msg49716.html . For example, how to mark all Firefox's packets, knowing that Firefox can spawn processes so the PID option isn't feasible.