1

http://postimg.org/image/b1w3bujnv/

I don't understand the highlighted part in red.

Firstly,Why is a packet filter is enough in a situation where traffic is busy?

Secondly,Isn't application proxy safer than packet filter considering proxy can filter bad data like virus?

Thirdly, is it okay to use stateful packet filter instead of packet filter?

Fourthly, when should i use non-stateful packet filter, stateful packet filter and application proxy?

  • By "application proxy", do you mean e.g. using Nginx or Apache as the proxy? – Philip Rowlands May 28 '16 at 16:33
  • @PhilipRowlands yes – Ricky May 28 '16 at 16:41
  • okay, that cleared it up. – Philip Rowlands May 28 '16 at 16:46
  • It's not that it's enough, I'd say the preference is because of the computational and thus hardware cost of a proxy over simplified packet filtering rules. – user7933 May 28 '16 at 16:50
2

An application proxy (or more commonly called application level gateway) is a firewall at the application level. A packet filter is a firewall at the packet level. This mean with a packet filter you are not able to filter web traffic for malware since it has no understanding of the applications protocols of the web (i.e. HTTP). An application level gateway instead understand the protocol and can thus scan the body of a HTTP response for malware.

See also the OSI model: a packet filter is at layer 4 while an application level gateway is at layer 7.

Firstly,Why is a packet filter is enough in a situation where traffic is busy?

This statement is wrong. The only criterion to decide if you use a packet filter or an application proxy should be the security requirements and not the performance. While a packet filter is much faster than an application proxy it is of no use if you actually need application level inspection.

But a packet filter has its use too as a way to separate networks or as the first line of defense like against DOS attacks.

Secondly,Isn't application proxy safer than packet filter considering proxy can filter bad data like virus?

That is correct and very important.

Thirdly, is it okay to use stateful packet filter instead of packet filter?

A stateful packet filter is still a packet filter so you can use it. Keeping states has the advantage that you can make more strict rules (i.e. based on connections and not on single packets). But it needs more memory.

0

As far I understand this, application proxies would need to be running on the server as applications, i.e. consuming memory and CPU. Meanwhile, packet filtering takes place at network level, i.e. before it even gets on to the server in the first place. That's going to be less computationally expensive, so a packet filter would allow greater throughput if there's a lot of traffic on the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.