Traditional packet filters are static and utilize rigid rule sets to allow or deny packets based solely on header content.
Dynamic rules enable a much more sophisticated level of filtering than traditional packet filtering.
WatchGuard's two-way packet filtering engine is one of the core features of its access control system. By itself, WatchGuard's stateful dynamic packet filtering provides a very powerful foundation for departmental or single-system firewalls aimed at safeguarding or restricting internal user access to critical systems. Flow analysis tools in the filter compiler can detect gross configuration errors and warn the user. Normally, such rules are implemented using built-in filtering functions implemented in C for improved performance. Certain aspects of the packet filtering engine can be modified by the engine itself or by transparent proxies.