Traffic filtering is a defensive control that inspects network or application requests and decides whether to allow, block, slow, or reroute them. It can operate at many layers, from firewalls and reverse proxies to cloud DDoS protection services and web application firewalls. Filters may use IP reputation, packet patterns, request rates, geolocation, protocol checks, or behavior signals to separate normal users from suspicious sources.
In cyber security, traffic filtering matters because many attacks begin as unwanted traffic. During a DDoS event, filtering can drop malicious packets, rate-limit abusive clients, or send traffic to scrubbing infrastructure before it reaches the service. It is also used against scanning, brute-force login attempts, bot activity, and exploit probes. Good filtering is careful: if it is too aggressive, it can block legitimate users and create its own outage. Effective defenders tune filters to reduce attack load while preserving access for real traffic.