In cybersecurity, traffic filtering is the process of checking and verifying each data packet transmitted or received over a network. If the traffic filter identifies threats or finds data whose signature matches known malware, it prevents such data packets from entering or leaving the network. The filter’s decision is based on preexisting rules established by the organization’s cybersecurity personnel.

Traffic filters, in a sense, work like overhead controls with height requirements that prevent oversized vehicles from entering particular roads, thus filtering road traffic.

Read More about Traffic Filtering

Filtering traffic provides an additional layer of security to Internet-connected networks. It can, in fact, serve as a network’s first line of defense. Learn more about the process here.

How Does a Traffic Filter Work?

A traffic filter is typically installed on a network firewall. It checks all incoming traffic for signs of malware involvement. It can verify the source first to see if it is a known threat vector, such as a Uniform Resource Locator (URL) connected to a malware command-and-control (C&C) server or malicious IP or email address. It then inspects the data packet to ensure it does not contain malware. If it passes the test based on rules predetermined by the cybersecurity team, it is allowed to pass through the firewall and enter the network. If it does not, it gets bounced.

In many cases, the filter also checks outgoing traffic to ensure no one within the network is sending malware to any recipient.

How Traffic Filtering Works

What Are the Popular Traffic Filtering Methods?

There are various ways to filter traffic. We discussed five of them below.

IP Address Blocking

IP address blocking is one of the best protection measures against distributed denial-of-service (DDoS) attacks. Traffic filters can be made to take a closer look at the origin IP address of a particular data packet. So long as that IP address is not on a blocklist, the packet is allowed to reach the network.

Rate Limiting

Rate limiting technology lets cybersecurity teams limit the maximum number of requests from one user per period. It can fully control any type of traffic measured in units like HyperText Transfer Protocol (HTTP) or Domain Name System (DNS) requests or packets of specific protocols. Network administrators can, for example, allow up to 50 Internet Control Message Protocol (ICMP) packets per second. This type of traffic filtering provides good protection against DDoS attacks.

Geoblocking

In addition to IP address blocking, filters can also be made to block all traffic related to IP addresses coming from a particular geolocation via geoblocking.

What Network Parameters Can Traffic Filters Detect?

Filtering traffic can protect networks against threats by checking out various parameters. Here are some of them.

  • Hosts: As mentioned earlier, traffic can be filtered based on its source IP address. If the sender’s IP address is in a blocklist, the traffic from it may need to be blocked.
  • Ports: While many ports must be kept open for network communication, those not in use should be kept shut. And whether or not ports are left open or closed, they should all be protected against exploitation and monitored for signs of malicious activity at all times.
  • Files: Another effective way to keep suspicious or outright malicious data out of networks is by limiting the size or even disallowing certain file types to come into the network. Malware usually comes in the form of executable (.exe) files, so preventing them from passing through the firewall is always a good idea.

—

While traffic filtering, like any other cybersecurity measure, is not foolproof, enabling it along with others still works.

Key Takeaways

  • Traffic filtering is the process of checking and verifying each data packet transmitted or received over a network.
  • Several methods exist, including IP address blocking, rate limiting, and geoblocking.
  • Traffic filters can monitor and perform checks for hosts, ports, and files.

Sources

  • https://www.elastic.co/guide/en/cloud/current/ec-traffic-filtering-deployment-configuration.html
  • https://d3fend.mitre.org/technique/d3f:InboundTrafficFiltering/
  • https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSlCAK