Although there are many different firewall devices and applications on the market, they can generally be catagorised into one of the following types:
They will either operate using a) packet filtering or b) application/proxy filtering.
Packet Filtering
This requires method requires analysing every packet of data that attempts cross over the firewall. Each packet is individualy analsyed for details including its protocol type, source/destination ports and direction with the results being compared to an access control list amongst others. The access control list contains a set of rules that are generated when the firewall is configured, by only allowing packets to cross the firewall if theymeet the criteria set in the rules it is possible to control and filter the data flow between the computer(s) and the internet.
This is advantageous as a third party hacking program may attempt to enter the computer system however the access control list may be configured to only allow data from specific programs to cross the firewall and therefore the attempts of the hacking application will be stoppped. This process also works in reverse as a trojan may be lurking behind the firewall on the computer and is attempting to send information out onto the internet, again if the access control list is correctly configured then the firewall will prevent the packets to cross.
Although being very thorough in its ability to monitor traffic flow this type of firewall does have its disadvantages. These are that the are can be performance issues as the data flow slows down as the firewall monitors and compared the data packets. Also it is possible for an experienced hacker to simply mask the packet type or port number to make the data appear to the firewall as though it matches the rules in the access control list.
As the example shows by analysing the data crossing the firewall and comparing the results to an access control list it is possible to allow applications such as email clients, web browsers and FTP clients to operate but unrecognised applications, in this example hacking tools, will be stopped.
