packet-filtering capability
163552·updated Aug 30, 2026A network security function — the ability to selectively control the flow of packets to or from an interface by examining information in each packet's header. It is built into most operating systems and routing devices and operates by inspecting packet-level attributes rather than packet content, with its access-control behavior governed by a configured ruleset. In security architecture and compliance contexts, it names the functional property that a device, system, or component is asserted to possess — the built-in or assignable ability to enforce network-layer access controls — and is used when specifying requirements (e.g., that a boundary component *provide* this capability) rather than describing a standalone firewall appliance. Packet-filtering capability is built into most operating systems and into devices capable of routing, such as a network router that employs access control lists.
Source
, provide a packet-filtering capability based onthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Filtering and route lookup in a switching device
- NIST SP 800-41, Revision 1, Guidelines on Firewalls and ...
- PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A network security function — <cite index="2-1">the ability to selectively control the flow of packets to or from an interface by examining information in each packet's header — that operates on inbound and outbound traffic based on combinations of fields such as source and destination IP addresses, IP protocol, and source and destination ports.</cite> It is built into most operating systems and routing-capable devices, with the network router employing access control lists being its most common pure instantiation. Unlike more advanced inspection methods, it does not analyze the content of packets; its access control functionality is governed by a set of directives referred to as a ruleset. In compliance and security architecture contexts, the expression names a functional attribute that a device, system, or boundary component either possesses or exposes — used to describe what network-layer enforcement a control point can provide, independently of whether that point is a dedicated firewall, a router, an operating system, or a multi-function gateway.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- packet-filtering capabilities
- possessive
- packet-filtering capability's
- pluralpossessive
- packet-filtering capabilities'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A network security function — the ability to selectively control the flow of packets to or from an interface by examining information in each packet's header. It is built into most operating systems and routing devices and operates by inspecting packet-level attributes rather than packet content, with its access-control behavior governed by a configured ruleset. In security architecture and compliance contexts, it names the functional property that a device, system, or component is asserted to possess — the built-in or assignable ability to enforce network-layer access controls — and is used when specifying requirements (e.g., that a boundary component *provide* this capability) rather than describing a standalone firewall appliance. Packet-filtering capability is built into most operating systems and into devices capable of routing, such as a network router that employs access control lists.DR-088 backfill from the noun definition column