0

I was reading about firewalls and I have this query.

Is each firewall a packet filter? Why or why not?

I know that the first generation of firewall's were essentially packet filters, but how does it work now?

Thanks

  • That is far too big generalization. First of all, there are various types of firewalls. Just check firewall page on Wikipedia. – Aria Jul 24 '16 at 17:04
3

A firewall is just some device or software which filters the network traffic. This can be done at the packet level (usually called packet filter firewall (PFL) or layer 3,4 firewall) but also at the application level (usually called application level firewall (ALG), secure web/mail gateway (SG, SWG...) or similar). You'll often find both PFL and ALG technologies in modern firewalls, i.e. some filtering is done at the packet level and some at the application level.

With a packet filter the filtering is done based on properties of the packet at layer 4,3 or even 2 (i.e. Port, IP, Mac). With application level firewalls filtering is done on the content of the application layer, i.e. URL, type of the content etc. For example pure packet filters cannot block malware by its content while application level filters can do it. But pure packet filters can block download of the malware if the IP address (not hostname!) is known to propagate malware and thus communication with this IP address can be simply denied.

  • And - actually - ALG's are not firewalls ;) they are an Application-Level Gateways, and the simpliest of them look/work like firewalls, but even an ordinary one of ALG's is a complete different kind of software – Alexey Vesnin Jul 24 '16 at 17:52
  • @AlexeyVesnin: "firewall" only describes a kind of separation device/software and not a specific technology. Such separation can be done at packet level or application level. Several of the so called NGFW (next generation firewalls) include application level gateways (filtering proxies). – Steffen Ullrich Jul 24 '16 at 20:37
  • agreed about NGFW, but - IMHO - ALG's are either NGFW or, mostly, DPI/DSI/IPS/IDS in some combo of mentioned techniques. In my opinion a firewall is a ruleset for filtering packets source+target+proto+flags, like IPFW – Alexey Vesnin Jul 24 '16 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.