Port Rule or Application Filter?

About this interactive

Most ACLs and firewall rules work at layers 3 and 4: the source and destination IP addresses, and the TCP or UDP port. Ports map to services, 20 and 21 to FTP, 22 to SSH, 80 to HTTP, so a rule on a port is usually a rule on a service. The mapping is a convention, not a guarantee. A web server can listen on 8080, and something that is not HTTP at all can run on port 80. A port rule cannot tell the difference, and adversaries use that: they send what they want through a port the firewall already trusts. Application-layer filtering looks past the headers into layer 7 to see which application protocol is actually in use, and whether it is what the rule expects. So ask of each job: is the port enough to identify the traffic here, or does someone have a reason to disguise it?

What you'll learn

Decide whether a filtering requirement can be met by a layer 3 and 4 rule on addresses and ports, or needs application-layer filtering that checks which application protocol is really in use
Explain why a port number does not guarantee the application: a service can run on a non-standard port, and another protocol can run on a standard one, which adversaries use to slip past port-based rules

Aligned to

CompTIA Security+

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

4.5 Given a scenario, modify enterprise capabilities to enhance security.

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

Key terms

Application Layer Filtering: A firewall capability that inspects traffic beyond Layer 3 and Layer 4 headers to identify and verify the actual application protocol in use, preventing adversaries from bypassing rules through port misuse.
Packet Filtering: A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Application Layer: The topmost layer of the OSI model (Layer 7) that provides network services directly to end-user applications.
Firewall: A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.

Topics

Application Layer Filtering Packet Filtering Application Layer Firewall Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →