Firewall Packet Filter Query

Question

I was reading about firewalls and I have this query.

Is each firewall a packet filter? Why or why not?

I know that the first generation of firewall's were essentially packet filters, but how does it work now?

Thanks

Answer 1

A firewall is just some device or software which filters the network traffic. This can be done at the packet level (usually called packet filter firewall (PFL) or layer 3,4 firewall) but also at the application level (usually called application level firewall (ALG), secure web/mail gateway (SG, SWG...) or similar). You'll often find both PFL and ALG technologies in modern firewalls, i.e. some filtering is done at the packet level and some at the application level.

With a packet filter the filtering is done based on properties of the packet at layer 4,3 or even 2 (i.e. Port, IP, Mac). With application level firewalls filtering is done on the content of the application layer, i.e. URL, type of the content etc. For example pure packet filters cannot block malware by its content while application level filters can do it. But pure packet filters can block download of the malware if the IP address (not hostname!) is known to propagate malware and thus communication with this IP address can be simply denied.