2

Why do we call packet filter firewalls .... packet filter firewalls?

A firewall operating as a packet filter passes or blocks traffic to specific addresses based on the type of application. The packet filter doesn’t analyze the data of a packet; it decides whether to pass it based on the packet’s addressing information. For instance, a packet filter may allow web traffic on port 80 and block Telnet traffic on port 23. This type of filtering is included in many routers. If a received packet request asks for a port that isn’t authorized, the filter may reject the request or simply ignore it.

I was always told and taught that ports belong to the Transport Layer, which is Layer 4, and what's in L4 is called a segment not a packet. Why do they call it packet firewall?

Improve this question
1
  • AFAIK they call them "packet filters" as they filter TCP/IP Packets. Exactly what layer the filter operates on doesn't really change the concept that packets are being filtered...
    – Rory McCune
    Nov 25, 2016 at 19:18

2 Answers 2

Reset to default
2

You are correct in that ports are part of layer 4, but packet filtering firewalls, even though they operate mostly on layer 3, also inspect the port numbers.

Even the simplest firewalls will do this, but because they do not make decisions based on the rest of the layer 4 data, "packet filtering" is appropriate. You could think of it as "enhanced packet" filtering.

Improve this answer
2
  • .@schroeder regarding "but because they do not make decisions based on the rest of the layer 4 data" you mean they only look at the port information in the TPC header ? They don't inspect SEQ # etc ?
    – cyzczy
    Nov 23, 2016 at 10:21
  • @adam86 stateful filters will inspect sequence numbers to try to establish whether a specific packet relates to an existing connection or not, non-stateful filters generally don't.
    – Rory McCune
    Nov 25, 2016 at 19:20
1

I was always told and taught that ports belong to the Transport Layer, which is Layer 4, and what's in L4 is called a segment not a packet. Why do they call it packet firewall?

When you speak of Layer 4, I believe you are referring to the OSI model's transport layer.

The OSI model is one way of implementing a layered network architecture, defined by the ISO/IEC 7498 series of standards. It is not the only one.

Particularly, IP uses a different model! IP's networking model overlaps with OSI in some respects, but is different in other regards.

IP's model is more like a five-layer model if we include the application layer (which in OSI is about how one applications talks to another, or in other words the contents of the data packets), and a four-layer model otherwise:

  • There's payload data
  • which is contained within a TCP or UDP packet
  • which is contained within an IP packet
  • which is contained within a physical network frame

In IP, the term (dating back at least to RFC 791) is packets (though datagrams is sometimes used), and in TCP or UDP, there are port numbers attached to these packets.

Hence it is technically correct to talk about for example TCP packets going to a specific port (or port range). IP itself has no concept of ports.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .