在构造安全的网络系统时,防火墙无疑是其中非常关键的部件。根据防火墙分析数据包的协议层次,可将防火墙分为网络级和应用/代理级两种。网络级防火墙主要根据数据包里的网络层地址和协议信息作出是否放行的决定。应用/代理级防火墙主要根据更商层协议信息作出是否放行的决定,趋向于提供较为详细的审核报告。防火墙在审查网络高层协议的通信方面有两种基本的倾向:其一,完全理解各协议并解析所有命令。这具有很高的安全性,但增加了防火墙实现上的复杂性,对网络性能也会有所影响。其二,只理解一些绝对必要的协议。这种做法快速、简单和灵活,但存在着允许不为防火墙所知的非法操作的风险。现代的防火墙都采取了折衷的做法。防火墙主要的任务就是根据网络信息包的内容进行过滤,对遭到的攻击进 When building a secure network system, a firewall is undoubtedly one of the most critical components. According to the packet analysis protocol firewall level, the firewall can be divided into network-level and application / agent level two. Network-level firewall mainly based on the data packet network layer address and protocol information to make the decision whether to release. Application / Proxy-level firewall mainly based on more information about the level of agreement to make a decision whether to release, tend to provide a more detailed audit report. Firewalls have two basic tendencies to review the communication of high-level protocols on the network: First, fully understand each protocol and resolve all commands. This has a high level of security, but adds complexity to the firewall implementation and affects network performance. Second, only understand some absolutely necessary agreements. This is fast, simple and flexible, but there is a risk of allowing unlawful operation not known to the firewall. Modern firewalls have taken a compromise approach. The main task of the firewall is based on the contents of the network packet filtering, attacks on