CyberGlossary

Network Security

Packet Filtering

Also known as: Packet filter

Definition

A network-security technique that inspects each packet's header fields and allows or drops it based on a static ruleset.

Packet filtering examines individual network packets at layer 3/4 and decides whether to permit or deny them based on header fields such as source and destination IP addresses, transport protocol, and ports, plus flags like TCP SYN/ACK. It is the simplest form of firewall, implemented in routers, OS kernels (iptables, nftables, pf, Windows Filtering Platform), and cloud ACLs. Filters can be stateless (each packet evaluated alone) or used as the data-plane of a stateful firewall. Packet filtering is fast and inexpensive but cannot understand application-layer context, encrypted payloads, or sophisticated evasion such as fragmentation overlap, making it one layer of a broader defence-in-depth design.

Examples

  • An iptables rule dropping all inbound TCP/23 (Telnet) on a Linux server.
  • An access-list on a Cisco IOS router blocking RFC1918 source addresses on the WAN interface.

Related terms