Flower filter classifier allow to do flow based filtering: filter's actions applied according to the matching of the flow on flower keys. For ex., to forward ICMP traffic only from device eth0 to eth1 following command from iproute2 package used:

$ tc filter add dev eth0 ingress protocol ip prio 1 \
    flower ip_proto icmp \
    action mirred egress redirect dev eth1

Or to drop all packets coming from some ethernet address:

$ tc filter add dev eth0 ingress protocol all prio 1 \
    flower src_mac de:ad:be:ef:00:00 \
    action gact drop