TechKnowSurge
TechKnowSurge Catalog Videos Application Layer Filtering
VideoSecurityFree

Application Layer Filtering

Application layer filtering allows firewalls to inspect actual traffic content rather than relying solely on port numbers, closing a significant gap that adversaries can exploit. This advancement helps ensure that the application communicating across the network matches what the firewall expects to see.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Firewalls have long used layer 3 and layer 4 information to make access control decisions, filtering traffic based on source and destination IP addresses and the port numbers found in TCP headers. Port numbers carry an implied association with specific services, such as port 22 for SSH or ports 20 and 21 for FTP, and for most traffic this mapping provides adequate control. However, these associations are conventions rather than enforced rules, meaning an application can operate on a non-standard port, or a standard port can carry traffic from a completely different application than expected. This gap creates a real security risk. An adversary aware of port-based filtering rules can route malicious traffic through permitted ports, effectively disguising it as legitimate application traffic and bypassing firewall controls that rely on port numbers alone. Application layer filtering closes this gap by allowing the firewall to inspect the content of traffic directly and determine what application is actually communicating, not just what port it is using. By verifying that the observed application behavior matches what is permitted on the network, application layer filtering provides a significantly stronger security posture than port-based rules alone. This capability represents an important evolution in firewall technology, giving organizations a more accurate and reliable method for controlling what crosses their network boundaries.

What you'll learn

What's covered

Application Layer Filtering

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Firewall
A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Application Layer
The topmost layer of the OSI model (Layer 7) that provides network services directly to end-user applications.
Transport Layer
Layer 4 of the OSI model, responsible for end-to-end communication, flow control, and error recovery.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Application Layer Filtering
A firewall capability that inspects traffic beyond Layer 3 and Layer 4 headers to identify and verify the actual application protocol in use, preventing adversaries from bypassing rules through port misuse.

Topics

Application Layer Filtering Firewall Deep Packet Inspection Port Based Filtering Network Security Osi Model

Transcript

Another advancement that firewalls took was filtering things at the application layer. It might sound like we've already done that when it comes to layer 4 and talking about ports, but there are ways to get around that.

Filtering at layers 3 and 4

When we're talking about ACLs and rules, we've been mainly talking about using layer 3 and 4. At layer 3, we want to filter things based off IP addresses, both the source and the destination IP addresses. Same thing with layer 4 when it comes to the port, and the port is associated with some sort of service. As an example, 20 and 21 is associated with FTP, or 22 with SSH, and so on and so forth. So we have these ports that are associated with certain services. By looking at the TCP header, we can know what the source port and destination port is, and we can use that information to either permit or block certain traffic.

Why a port doesn't guarantee the application

The problem is that even though there's an association between an application and the port that it uses, it's not always exactly the same. As an example, HTTP: the standard port for it is port 80, so we have a correlation between port 80 and HTTP. The problem is that we could set it to something else, like we could set it to port 8080, or we could have port 80 that's associated with some other service like FTP. So just because we specify a port doesn't necessarily mean that is the application that's 100% associated with that port.

Looking into the application layer

If we have a firewall and it's strictly based off of the port, many times, most times, that is going to be sufficient enough, but adversaries can use this mapping to be able to carry out certain attacks that we need to be concerned with. So we need to look into the application layer and see what it's doing. As firewalls started progressing, they started looking at this application layer and figuring out what is the application that's actually trying to be communicated here, and does it line up with what it's expecting or what it's allowing across this network. So it's just one advancement that firewalls took to help our networks be more secure.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →