Packet filtering is a firewall feature that allows or drops data packets based on simple, pre-defined rules regarding IP addresses, ports, or protocols.
Each data packet consists of three components: a header to provide information about the data packet, a payload of data, and a trailer to show the end of the packet.
Packet filtering analyzes the information within each data packet header and compares it against the rules to determine whether to allow or deny the packet.
Filtering typically drops denied packets, sometimes with little to no information regarding the violated packet rules in log files.
Administrators often apply tailored packet filtering rules to regulate inbound and outbound traffic differently.
The first firewalls created performed packet filtering; inexpensive network firewalls and host firewalls installed on network routers can still focus on packet filtering.
Packet filtering rules encompass a subset of general firewall rules focused on header information in the data packet.
A set of rules composes an overall policy that can be applied to multiple devices performing packet filtering throughout an organization.
These cost and performance advantages drive the use of packet filtering for a spectrum of solutions from complex NGFWs to simple routers that include a host firewall.
Misplaced trust: Treats all communication traffic that can pass the basic packet filtering rules, even malicious content, as safe traffic to be trusted.
Most commercial firewalls package packet filtering alongside advanced features for more dynamic and complex analysis of packets to improve security.
Static rules only pair with stateless packet filtering, and stateful packet filtering rules require dynamic packet filtering.
Static packet filtering uses fixed and unchangeable rules.
Stateless packet filtering relies completely on pre-defined filtering rules to decide whether to allow or drop a packet.
Stateless filtering applies to both static and dynamic filtering rules and treats each packet independently from other packets.
The filtering solution retains no data, even information regarding malicious packets previously dropped, as context for future filtering decisions.
Stateful packet filtering considers packets in the context of established transmission connections during the allow or drop decision-making process.
Admins use the feature to execute specific use cases that capitalize on the advantages of packet filtering.
Packet filtering quickly identifies and drops external IP spoofing attacks that claim to originate from internal network sources when enforcing a rule that no traffic outside the network can claim to be a device from within the network.
Packet filtering provides fast data packet filtering for networks and devices and is the first critical layer of security.
This Cyber News was published on www.esecurityplanet.com. Publication date: Tue, 13 Feb 2024 23:43:05 +0000