ure when combined with additional firewall capabilities. It was initially believed that a firewall was the solution to all our Internet security problems. The limitations of a firewall's only implementation are now apparent. If we only need to communicate between specific networks or specific devices with fixed IP addresses, a firewall is a fine solution. TCP Filtering The next level of checking that the firewall provides is to check inside the TCP packet for port number. For example, the standard TCP port for HTTP is port 80. (Any port can be could be used in this example. Port 8080 is another port frequently used by proxies.) The firewall now checks for IP Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. X.25, Internets, Intranets, and Extranets X.25, Internets, Intranets, and Extranets addresses (which might say any IP address) and the port number in the TCP packet. This means that unless the port is open through the firewall, service can- not be reached (such as HTTP or FTP). This provides for a more general audience. Now instead of filtering on an IP address one can say let anybody from any IP address come through the firewall, but only if he or she is doing HTTP on port 80 to a specific server. This means that other Web pages may be on other servers on port 80 internally, but they would not be available because the firewall limits access to a specific server. Clearly, access may be granted to as many servers as desired. This presentation is a little simplistic because it makes the assumption that the OS on which the firewall software is running is itself secure and unhackable. Not only is this not generally true, but it is impossible to secure the OS perfectly. (For example, attacks have occurred to a UNIX-based sys- tem that is running send mail. Therefore, the send mail application should not be present on your firewall machine. One o