Changing packet payload with tc

How can tc be used to match a particular payload of an ingress packet, e.g., if the first 32 bits of payload of an IP/UDP packet are equal to some constant $c, the value $c should be changed to $d? This should work in particular for variable length IP headers. It appears that the u32 filter should be able to perform the matching. Is the following attempt correct? I am not sure about the nexthdr part in particular. tc filter add dev protocol ip parent ffff: u32 match $c 0xffffffff at nexthdr+8 Now pedit can be used to change the packet but I don't see a way to write $d in the UDP payload of a packet with variable length IP header. Any help is appreciated.