When packet filtering rules, called access control lists in Cisco routers, are applied to a network interface, the headers are copied into the memory accessible to the routers' CPU and checked against the access control list rules. If the packet is permitted, it is routed on to the next hop. If the packet is denied by the rules, the packet is dropped, and an ICMP message may be sent back to the sending system so more packets will not be sent. Routers have serious limitations when used for packet filtering. The router's CPU handles the filtering operation instead of dedicated hardware, which means the filtering operation is much slower than simply routing packets.
Routers manifest another problem based on their very design.
Routers maintain state information, used to make decisions about how to deal with packets, in the form of routing tables. The router deals with each packet that arrives as if the packet was unique, not part of a stream, or flow, of packets as is generally the case. Filtering decisions are also made as if each packet which arrived was unique, and no other similar packets had ever or would ever arrive with similar headers. The way routers deal with packets affects their security capabilities in several ways. Router performance is reduced because the same filtering decision must be made over and over again.