we can say linux firewall is applicaiton level firewal?

How are you.
As I know linux firewall using iptables is kenel level firewal.

When we talking about string match of iptables , I'd like to know whether if
we can say linux firewall is applicaiton level firewal?
then in kernel level , open all tcp body and look at some string from tcp
body.

when we enable string match ,how about network performac?


Have a nice day.

somez72 wrote:
> How are you.
> As I know linux firewall using iptables is kenel level firewal.
>
> When we talking about string match of iptables , I'd like to know whether if
> we can say linux firewall is applicaiton level firewal?

Not sure about that, but i don't think so. Maybe if you analyze all
first packets sent from any possible application and setup the string
matched rules, it might be.

> then in kernel level , open all tcp body and look at some string from tcp
> body.
>
> when we enable string match ,how about network performac?

What traffic load are we talking about?
Basically it depends on the firewall box itself. If enough hardware
resources are available it shouldn't be a problem.

cheers,
Eric