Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the valid traffic not flagged/blocked/filtered by the firewall.

If nothing exists that is firewall-specific, is there any general term used for traffic being monitored (input), and/or traffic successfully passing said monitoring (output)?

  • 4
    To be honest, you have some strange criteria for the traffic, so I'm not sure if any answer would be accurate. All traffic, in and out, is (should be) inspected. From there, you have 'allowed' and 'blocked' traffic. – schroeder Apr 20 '15 at 17:33

Maybe you are thinking of:

  • Ingress which indicates inbound flow, for instance flows coming from Internet to your LAN/DMZ,
  • Egress which indicates outbound flow, for instance flow leaving your LAN toward the Internet.

These will be handled in quite a different way regarding your firewall policy.

If you are just referring to data coming to the firewall itself to be analyzed (no matter the origin) and the accepted data that the firewall let pass out, then as far as I know it is just as you said in the title: input and output flow, as it would be for any other kind of network device.

  • 1
    Exfiltration and infiltration are also traffic classes, but unless they're part of a honeynet they should be thoroughly stomped on rather than monitored. – ǝɲǝɲbρɯͽ Apr 20 '15 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.