Linux kernel generates duplicated tc u32 filter handles

The current port mapping network isolator constantly create/remove tc u32 filters when launching/destroying containers.

We rely on the kernel to automatically generate unique tc 32 filter handles. However, seems that the handle generation logic in the current kernel is buggy, causing filters with duplicated handles. That could cause some filter become unremovable, leading to subsequent failures.

Here is a quote about how kernel generates tc u32 filter handles:
http://ace-host.stuart.id.au/russell/files/tc/doc/cls_u32.txt

Filter Item numbers must lie between 001 and fff hex.  The
traffic control engine will generate a filter item number for
you if you don't supply one.  The generated number is the
larger of 800 and one bigger than the current largest item
number in the bucket.