5.3Network security implementation

When designing perimeter defense, simply "putting up a firewall" is not enough—the choice of which layer to inspect at and at what granularity (a single packet, the whole flow, or even the application content) determines the trade-off between defense strength and performance/operational cost. This section organizes representative network security implementation techniques along the axes of inspection granularity, the perimeter-defense requirement each suits, and its weaknesses.

5.3.1Packet filtering, stateful inspection, and application gateways

• Packet filtering is the most basic approach: it decides whether to pass a packet by looking only at header information for that single packet, such as source/destination IP address and port number. Because it judges each packet independently, it does not consider the context of an ongoing communication (e.g., whether the packet is a response). It is fast, but weak against response packets forged to look like part of a legitimate exchange.
• Stateful inspection remembers the session state of a communication (which flow started when and what response is expected) and passes only packets consistent with that context. It catches "forged packets injected outside a legitimate session" that packet filtering would miss, and can safely allow return traffic on dynamically assigned ports.
• An application gateway (application-level gateway) analyzes the actual content of an application-layer protocol (HTTP, FTP, etc.) to decide whether to pass it (often operating as a proxy). It enables fine-grained control based on the communication content (URLs, commands, etc.), but requires protocol-specific parsing logic, incurs higher processing overhead, and costs more in development effort to add support for new protocols.