Packet Filter
A packet filter is the most basic type of a firewall, since it filters only at the network and
transport layers (layers two and three). Therefore, a packet filter’s operations are similar
to a network router’s. The packet filter receives a packet, determines the appropriate
action based on the policy, and then performs the action on the packet. This will be based
on the information from the network and transport layers. Therefore, a packet filter
considers only the IP addresses (layer two information), the port numbers (layer one
information), and the transport protocol type (layer three information). Furthermore, since
all this information resides in the packet header, there is no need to inspect the packet
data (payload). It is possible to filter based on the data link layer, but this chapter considers
only the network layer and above. Another important note is that the packet filter has no
memory (or state) regarding the packets that have arrived and departed.