IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- If required, the packet filter should support dynamic packet filtration. This
means that during the transmission of UDP packets, for example, the
related context is stored for a particular time period and the corresponding
response packets are allowed to pass through.
Dynamic filters
Based on the definition of a packet filter as a filter which uses the information
of layers three and four as a check, the limits of this procedure soon become
apparent. Although it is possible, in the case of TCP (Transmission Control
Protocol) to recognise the establishment of a connection and thereby prohibit
connections from the Internet to the network requiring protection, this is no
longer possible in the case of UDP (User Datagram Protocol). In order to
solve this problem, dynamic packet filters are used. If a UDP packet is sent
from an internal computer to a DNS server in the Internet, the dynamic packet
filter stores the data (source and destination address, source and destination
port) and produces a new permission rule for the response packets. This rule is
only valid for a certain period, which can be adjusted. If no response packets
are received, it is deleted.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000