Subject: Advanced Network Technologies

Topic: Network Security

Difficulty: High

On the Internet, packet filtering is the process of passing or blocking packets at a network interface based on source and destination addresses, ports, or protocols. The process is used in conjunction with packet mangling and Network Address Translation (NAT). Packet filtering is often part of a firewall program for protecting a local network from unwanted intrusion. packet filtering is done by a program called a packet filter. The packet filter examines the header of each packet based on a specific set of rules, and on that basis, decides to prevent it from passing (called DROP) or allow it to pass (called ACCEPT). A packet filtering router is able to filter IP packets based on the

Source IP address

Destination IP address

TCP/UDP source port

TCP/UDP destination port

Packet filters works well for blocking spoofed packets. It also can be used for

Block connections from specific hosts or networks

Block connections to specific hosts or networks

Block connections to specific ports

Block connections from specific ports

Advantages Low cost.

Packet filters make use of current network routers.

Makes Security Transparent to End-Users.

Easy to install.

Packet filters make use of current network routers. Therefore implementing a packet filter security system is typically less complicated than other network security solutions.

High speed

Packet filters are generally faster than other firewall technologies because they perform fewer evaluations.

Disadvantages

Packet filters do not understand application layer protocols.

Packet filters does not offer any value-added features, such as HTTP object caching, URL filtering, and authentication because they do not understand the protocols being used.

Packet filtering routers are not very secure.

Can't discriminate between good and bad packet

New rules may be needed to be added if an employee needs special requirements to connect to the internet.

Difficulty of setting up packet filtering rules to the router

There isn't any sort of user based Authentication.

Packet filter cannot authenticate information coming from a specific user