data travels on the internet in small pieces; these are called packets. each packet has certain metadata attached, like where it is coming from, and where it should be sent to. the easiest thing to do is to look at the metadata. based on rules, certain packets are then dropped or rejected. all firewalls can do this. it is done at the network layer.