2

Why do we call packet filter firewalls .... packet filter firewalls?

A firewall operating as a packet filter passes or blocks traffic to specific addresses based on the type of application. The packet filter doesn’t analyze the data of a packet; it decides whether to pass it based on the packet’s addressing information. For instance, a packet filter may allow web traffic on port 80 and block Telnet traffic on port 23. This type of filtering is included in many routers. If a received packet request asks for a port that isn’t authorized, the filter may reject the request or simply ignore it.

I was always told and taught that ports belong to the Transport Layer, which is Layer 4, and what's in L4 is called a segment not a packet. Why do they call it packet firewall?

  • AFAIK they call them "packet filters" as they filter TCP/IP Packets. Exactly what layer the filter operates on doesn't really change the concept that packets are being filtered... – Rоry McCune Nov 25 '16 at 19:18
2

You are correct in that ports are part of layer 4, but packet filtering firewalls, even though they operate mostly on layer 3, also inspect the port numbers.

Even the simplest firewalls will do this, but because they do not make decisions based on the rest of the layer 4 data, "packet filtering" is appropriate. You could think of it as "enhanced packet" filtering.

  • .@schroeder regarding "but because they do not make decisions based on the rest of the layer 4 data" you mean they only look at the port information in the TPC header ? They don't inspect SEQ # etc ? – cyzczy Nov 23 '16 at 10:21
  • @adam86 stateful filters will inspect sequence numbers to try to establish whether a specific packet relates to an existing connection or not, non-stateful filters generally don't. – Rоry McCune Nov 25 '16 at 19:20
1

I was always told and taught that ports belong to the Transport Layer, which is Layer 4, and what's in L4 is called a segment not a packet. Why do they call it packet firewall?

When you speak of Layer 4, I believe you are referring to the OSI model's transport layer.

The OSI model is one way of implementing a layered network architecture, defined by the ISO/IEC 7498 series of standards. It is not the only one.

Particularly, IP uses a different model! IP's networking model overlaps with OSI in some respects, but is different in other regards.

IP's model is more like a five-layer model if we include the application layer (which in OSI is about how one applications talks to another, or in other words the contents of the data packets), and a four-layer model otherwise:

  • There's payload data
  • which is contained within a TCP or UDP packet
  • which is contained within an IP packet
  • which is contained within a physical network frame

In IP, the term (dating back at least to RFC 791) is packets (though datagrams is sometimes used), and in TCP or UDP, there are port numbers attached to these packets.

Hence it is technically correct to talk about for example TCP packets going to a specific port (or port range). IP itself has no concept of ports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.