Packetfiltering

Packet filtering is a network security technique that governs access to a network by inspecting each packet that passes through a boundary device, such as a firewall or router, and making a decision to allow or deny based on a set of rules. It operates at the network or transport layer, using information in the packet header to determine whether it should be forwarded.

There are two main approaches: stateless and stateful filtering. Stateless filtering evaluates only packet headers and does not consider prior packets, making decisions quickly but potentially less effective against certain threats. Stateful filtering tracks the state of active connections, maintaining a session table and allowing decisions based on connection context, such as whether a TCP handshake has completed.

Rules typically specify source and destination IP addresses, source and destination ports, and the protocol (TCP, UDP, ICMP). Some systems also filter on interfaces, time, or direction. Rules are usually arranged in a list or table; most devices apply an implicit deny at the end of the rule set.

Common implementations include access control lists on routers and dedicated packet-filtering firewalls. Performance considerations include throughput, latency, and resource usage; stateless filtering generally requires fewer resources, while stateful filtering can be more CPU-intensive and may benefit from hardware acceleration.

Limitations include the inability to inspect encrypted payloads, potential gaps against application-layer threats, and vulnerability to IP spoofing or evasion techniques. Misconfigurations can create allow or block gaps. Packet filtering is most effective when used as part of a layered defense, complemented by deeper packet inspection and other security controls.