> What's the point in filtering packets headed for ports that are closed anyway?

Yes, but programs open ports all the time expecting to recieve data. A web browser receives data on a port every time it makes a connection, and programs like FTP (in "active" mode) and file sharing programs basically act like servers. It's important that they only receive correctly formatted responses coming from the correct source. Firewalls can help to assure this.

Filtering outgoing packets is useful too.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/256/27654#27654