protocolfiltering

Protocol filtering is the practice of controlling network access by allowing or denying traffic based on the protocol type or characteristics of the traffic. It is used to enforce security and policy decisions by examining how data is transported across a network, rather than just where it originates or terminates.

Protocol filtering can operate at multiple layers and with varying depth. Packet-level filtering looks at basic metadata such as IP addresses, ports, and the protocol field in the header to permit or block traffic. Stateful filtering adds awareness of connection state, remembering legitimate ongoing sessions to distinguish between new and existing connections. Application-aware or deep packet inspection (DPI) goes further, inspecting the payload to identify specific application protocols or services (for example HTTP, FTP, or VPN protocols) and applying policies accordingly.

Techniques include field-based rules in firewalls or routers, state tables for connection tracking, and protocol-aware gateways or proxies that translate or mediate certain protocols. The granularity can range from blocking entire protocols (e.g., blocking ICMP or FTP) to permitting only specific applications or features within a protocol (for instance, allowing HTTP but restricting certain methods).

Common use cases include enforcing organizational security policies, preventing data exfiltration, complying with regulatory requirements, and managing bandwidth. Limitations encompass the potential for evasion via tunneling or encryption, the possibility of false positives or negatives, performance overhead from inspection, and privacy concerns related to in-depth traffic analysis. Effective protocol filtering often requires regular updates to rules and signatures and a balance between security and network usability.