Raw socket does not originate some specific kind of traffic that is "raw", distinct from TCP or UDP or whatever. Raw socket takes L2 = Ethernet frames whole, and it's up to the application to deal with the upper layers. For instance, the ISC DHCP daemon uses a raw socket - thus, it's not subject to local iptables on the same host, but the ISC dhcpd must understand IP and UDP and deal with them on its own.
If you have a suspicious neighbor machine (or a VM) where some software is known to open a raw socket, you do not need to "filter against raw traffic" - you just need to apply "least privilege" = permit select few TCP/UDP ports (and maybe some necessary ICMP) and drop all the rest. Whether the suspect host initiates its traffic via raw sockets or proper TCP/UDP sockets (using its respective OS'es L3/4/5 stack) is irrelevant. Or, if you have some software using a raw socket on the host that you want to keep safe, that software must weed out the traffic it's interested in, and ignore the rest. That way, the raw socket is not principally an inbound security hole.
The DHCP daemon is a good example. It does listen on a raw socket, but in principle it only inspects UDP destined to a well-known port 67. It's only ever willing to respond to packets that mach those criteria. It won't respond to a TCP SYN packet to some random port, and cannot be affected by those kinds of connection attempts, legit or malicious or whatever. So if you only want to expose the dhcpd's UDP port 67 to the suspicious network, you can pretty much apply iptables -A INPUT -i eth123 -j DROP , you do not even need to selectively permit UDP port 67 inbound, because dhcpd's raw socket will circumvent iptables anyway - for its own traffic only.
Also, using a raw socket to speak TCP is a pretty stupid idea. You'd probably have to implement the whole TCP stack in your application = what a waste of effort. Unless you merely want to pull off some attacks along the lines of "new not syn" etc where all you need to know is the right format of the packet to target, say, an overflow hole in a particular TCP stack implementation (the one you're trying to attack).
