> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-miect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-miect/seguranca-em-redes-de-comunicacoes/network-flow-control/control-by-analysis-of-higher-layers.md).

# Control By Analysis of Higher Layers

Traffic flow control based on higher layer data/protocols only works with not ciphered traffic.

Some firewalls provide decryption and inspection of SSL/TLS traffic.

Traffic deciphering may be achieved using a root certificate on client machines, acting as Certificate Authority for SSL requests.

* Firewalls must issue certificates to clients on behalf of the web servers they are connecting to.
* Firewalls intercept SSL/TLS handshake.
* Requires client device level changes.

Implementing this technique is processor-intensive.

* Results in performance degradation.
* Can be avoided by off-loading SSL/TLS decryption to a dedicated device.

May break privacy/confidentiality laws and rights in some countries.