From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.

But I don’t really see the difference--beyond the obvious fact that application-level gateways seem to operate on a higher level of the network protocol stack. Can someone flesh out the key differences?

2 Answers 2


Good question. Let's think about it this way:

You're going to take a basic maths exam and the sign on the door says

"No Masters-level students. No calculators allowed."

A normal inspector (firewall) would ask you for a student ID to make sure you're not an Masters student, then they'd let you in. A Masters student who looks just like you comes to the door, the firewall would remember that he checked him a couple of minutes ago and he'd let him in, therefor breaking the exam's security.

After checking your identity, a circuit-level gateway would've given you a watermarked paper that says you've been checked, so when your doppelgänger has to show the watermarked paper or else he'd have to go through an ID check, and his true identity as a Masters student will be revealed.

An application-level gateway, however, would've frisked you (DPI) looking for a calculator. As a calculator (application-specific command) isn't part of your identity, so it's something that sits on a higher level that the circuit-level gateway doesn't understand.

An application-level gateway understands all the protocols it supports, it doesn't care if your IP is whitelisted on the circuit-level, it can read your FTP traffic and figure out when you use the delete command and drop that exact packet. It can dissect your HTTP traffic and stop you from sending POST requests.

  • "a circuit-level gateway would've given you a watermarked paper that says you've been checked" -- But what happens when you drop that watermarked paper out the window to someone who looks nothing like you and they walk up to the circuit-level gateway?
    – ruffin
    Sep 30, 2014 at 21:16
  • Network/circuit based firewalls look no further than Layer 3 of OSI model, and therefore enforce security for TCP/UDP protocols only (e.g. it can only check that say TCP packet flags are legal according to the TCP standard)
  • Application gateways, on the other hand, look up to and including Layer 7 of OSI model and have the understanding of protocols used by specific applications (e.g. it may not only make sure that TCP flags are legal for network mail software, but also make sure no illegal SMTP commands are sent over the connection).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .