have you looked at SK_SKB hook? It is called when a message is enqueued to the socket's receive queue. So, it has the same behavior as a socket program.