Allow/Deny packets based on packet data:

• Layer 2:

  • Source or Destination MAC addresses

• Layer 3:

  • Source or Destination addresses, ports
  • Protocol or Protocol details
    • ex: disallow IP Source Routing
    • disallow ICMP redirect packets
    • disallow common “malicious” packet signatures