At which layer does a packet filtering firewall check data packets?

A packet filtering firewall primarily operates at the network layer of the OSI model. This layer is responsible for moving packets between the source and destination across different networks, using logical addressing (IP addresses). When a packet arrives at the firewall, it examines the header of the packet to determine source and destination IP addresses, as well as protocol information. Based on predefined security rules, the firewall can either allow or block the packet from passing through. This capability to filter packets based on their network layer attributes is fundamental to its function in protecting network resources.

In contrast, the application layer deals with higher-level protocols and user interfaces, handling specific applications and service requests. The physical layer concerns the transmission and reception of raw bit streams over a physical medium, which is unrelated to filtering packets based on their content. The link layer is responsible for node-to-node data transfer and can manage error detection and correction for frames, but it does not involve the logical routing of packets that the network layer does. Thus, the correct identification of the network layer as the operational layer for packet filtering firewalls captures the essence of how these security devices function within a network architecture.