A filter that alters IP traffic each time it enters the protocol stack. By its very nature, an IP filter can only filter in-band communication.