Gauntlet firewalls' security dominance. Description Application layer filtering operates at a higher level than traditional security appliances. This allows packet decisions to be made based on more than just source/destination IP Address or ports and can also use information spanning across multiple connections for any given host. Network-based application firewalls Network-based application firewalls operate at the application layer of a TCP/IP stack and can understand certain applications and protocols such as File Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol (HTTP). This allows it to identify unwanted applications or services using a non standard port or detect if an allowed protocol is being abused. Modern versions of network-based application firewalls can include the following technologies: Encryption offloading Intrusion prevention system Data loss prevention Web application firewalls (WAF) are a specialized version of a network-based appliance that acts as a reverse proxy, inspecting traffic before being forwarded to an associated server. Host-based application firewalls A host-based application firewall monitors application system calls or other general system communication. This gives more granularity and control, but is limited to only protecting the host it is running on. Control is applied by filtering on a per process basis. Generally, prompts are used to define rules for processes that have not yet received a connection. Further filtering can be done by examining the process ID of the owner of the data packets. Many host-based application firewalls are combined or used in conjunction with a packet filter. Due to technological limitations, modern solutions such as sandboxing are being used as a replacement of host-based application firewalls to protect system processes. Implementations There are various application firewalls available, including both free and open source software and commercial products. Mac OS X Starting with Mac OS X Leopard, an implementation of the TrustedBSD MAC framework (taken from FreeBSD), was included. The TrustedBSD MAC framework is used to sandbox services and provides a firewall layer given the configuration of the sharing services in Mac OS X Leopard and Snow Leopard. Third-party applications can provide extended functionality, including filtering out outgoing connections by app. Linux This is a list of security software packages for Linux, allowing filtering of application to OS communication, possibly on a by-user basis: AppArmor Kerio Control - a commercial Product ModSecurity - also works under Windows, Mac OS X, Solaris and other versions of Unix. ModSecurity is designed to work with the web-servers