A middlebox is a computer networking device that transforms, inspects, filters, and manipulates traffic for purposes other than packet forwarding.¹ Examples of middleboxes include firewalls, network address translators (NATs), load balancers, and deep packet inspection (DPI) devices.²

The term middlebox was coined in 1999 by UCLA computer science professor Lixia Zhang.¹³

Usage

Middleboxes are widely deployed across both private and public networks. Dedicated middlebox hardware is widely deployed in enterprise networks to improve network security and performance; however, even home network routers often have integrated firewall, NAT, or other middlebox functionality.⁴ One 2017 study counted more than 1,000 deployments in autonomous systems, in both directions of traffic flows, and across a wide range networks, including mobile operators and data center networks.²

Examples

The following are examples of commonly-deployed middleboxes:

Firewalls filter traffic based on a set of predefined security rules defined by a network administrator. IP firewalls reject packets "based purely on fields in the IP and transport headers (e.g., disallow incoming traffic to certain port numbers, disallow any traffic to certain subnets etc.)"¹ Other types of firewalls may use more complex rulesets, including those that inspect traffic at the session or application layer.⁵
Intrusion detection systems (IDSs) monitor traffic and collect data for offline analysis for security anomalies. Unlike firewalls, IDSs do not filter packets in real time, as they are capable of more complex inspection and must decide whether to accept or reject each packet as it arrives.⁶
Network address translators (NATs) replace the source and/or destination IP addresses of packets that traverse them. Typically, NATs are deployed to allow multiple end hosts to share a single IP address: hosts "behind" the NAT are assigned a private IP address and their packets destined to the public Internet traverse a NAT, which replaces their internal private address with a shared public address.⁷ These are widely used by cellular network providers to manage scarce resources.⁸
WAN optimizers improve bandwidth consumption and perceived latency between endpoints. Typically deployed in large enterprises, WAN optimizers are deployed near both sending and receiving endpoints of communication; the devices then coordinate to cache and compress traffic that traverses the Internet.⁹
Load balancers provide one point of entry to a service, but forward traffic flows to one or more hosts that actually provide the service.
Cellular networks use middleboxes to ensure scarce network resources are used efficiently as well as to protect client devices.

Criticism and challenges

Middleboxes have generated technical challenges for application development and have incurred "scorn" and "dismay" in the network architecture community¹⁰ for violating the end-to-end principle of computer system design.¹¹

Application interference

Some middleboxes interfere with application functionality, restricting or preventing end host applications from performing properly.

In particular, network address translators (NATs) present a challenge in that NAT devices divide traffic destined to a public IP address across several receivers. When connections between a host on the Internet and a host behind the NAT are initiated by the host behind the NAT, the NAT learns that traffic for that connection belongs to the local host. Thus, when traffic coming from the Internet is destined to the public (shared) address on a particular port, the NAT can direct the traffic to the appropriate host. However, connections initiated by a host on the Internet do not present the NAT any opportunity to "learn" which internal host the connection belongs to. Moreover, the internal host itself may not even know its own public IP address to announce to potential clients what address to connect to. To resolve this issue, several new protocols have been proposed.¹²¹³¹⁴

Additionally, because middlebox deployments by cell operators such as AT&T and T-Mobile are opaque, application developers are often "unaware of the middlebox policies enforced by operators", while operators lack full knowledge about application behavior and requirements. For example, one carrier set an "aggressive timeout value to quickly recycle the resources held by inactive connections in the firewall, unexpectedly causing frequent disruptions to long-lived and occasionally idle connections maintained by applications such as and ".

References

1Brian Carpenter (2002). "Middleboxes: Taxonomy and Issues". Ietf Datatracker. doi:10.17487/RFC3234. RFC 3234.
2Shan Huang; Steve Uhlig; Félix Cuadrado (2017). "Middleboxes in the Internet: A HTTP perspective". 2017 Network Traffic Measurement and Analysis Conference (TMA). pp. 1–9. doi:10.23919/TMA.2017.8002906. ISBN 978-3-901882-95-1. S2CID 34925433.
3Kromhout, Wileen Wong (February 2, 2012), "Lixia Zhang named to UCLA's Jonathan B. Postel Chair in Computer Science", UCLA Newsroom, archived from the original on April 25, 2019, retrieved 2015-06-14

Recent changes

90 revisions in total · 58 contributors · +5 / 0 bytes across 1 edits by 1 contributor in the last 30 days

15 Oct 2026, 23:03 UTCSchlurcherBotmBot: http → https+5diff
11 May 2026, 15:11 UTCDualcerbmReverted 1 edit by ~2026-28511-89 (talk) to last revision by Citation bot0diff
11 May 2026, 15:10 UTCTemporary accountrevertedNo edit summary0diff
26 Aug 2025, 22:52 UTCCitation botRemoved URL that duplicated identifier. Removed parameters. | Use this bot. Report bugs. | Suggested by Headbomb | Linked from Wikipedia:WikiProject_Academic_Journals/Journals_cited_by_Wikipedia/Sandbox | #UCB_webform_linked 752/990−241diff
10 Sept 2024, 01:07 UTCPaulTanenbaummmicrotweak for readability+7diff
19 Apr 2024, 14:20 UTCAnimMouseNo edit summary−7diff
13 Apr 2024, 08:47 UTCLucasBrownmGrammar+11diff
24 Jan 2024, 23:35 UTCDavid EppsteinZ. Morley Mao+4diff

View full revision history

Rabbit hole

Where Middlebox leads. Every connection below has a source: a link in this article, a shared Wikipedia category, or CirrusSearch text similarity. Articles already on your trail are left out.

Go deeper: linked from this article

Listed under See also
End-to-end principle
Design principle for computer networking
The end-to-end (E2E) principle is a design principle in computer networking that requires application-specific features (such as reliability and security) to be implemented in the communicating end nodes of the network, instead of in the network itself.
13 min readGo deeper
Linked from the introduction
Deep packet inspection
Procedures examining network data
Deep packet inspection (DPI) is a type of data processing that inspects in detail the data (packets) being sent over a computer network, and may take actions such as alerting, blocking, re-routing, or logging them accordingly.
16 min readGo deeper
Linked from the introduction
Computer network
Network that allows computers to share resources and communicate with each other
In computer science, computer engineering, and telecommunications, a network is a group of communicating computers and peripherals called hosts, which communicate data to other hosts via communication protocols, as facilitated by networking hardware.
37 min readGo deeper
Linked from the introduction
Load balancing (computing)
Digital workload distribution techniques
In computing, load balancing is the process of distributing a set of tasks over a set of resources (computing units) with the aim of making their overall processing more efficient.
18 min readGo deeper
Listed under See also
Multilayer switch
Network switch providing functionality above the data link layer
A multilayer switch (MLS) is a computer networking device that switches on OSI layer 2 like an ordinary network switch and provides extra functions on higher OSI layers.
5 min readGo deeper
Linked from the introduction
University of California, Los Angeles
American public research university
The University of California, Los Angeles (UCLA) is a public land-grant research university in the Westwood neighborhood of Los Angeles, California, United States.
66 min readGo deeper
Linked from the introduction
Firewall (computing)
Software or hardware-based network security system
In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on configurable security rules.
10 min readGo deeper
Linked from the introduction
Network address translation
Way to traverse IP address spaces without routing
Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.
17 min readGo deeper
Listed under See also
Traversal Using Relays around NAT
Computer network protocol
Traversal Using Relays around NAT (TURN) is a protocol that assists in traversal of network address translators (NAT) or firewalls for multimedia applications.
2 min readGo deeper
Listed under See also
STUN
Network protocol and related functions
STUN (Session Traversal Utilities for NAT; originally Simple Traversal of User Datagram Protocol (UDP) through Network Address Translators) is a standardized set of methods, including a network…
3 min readGo deeper

Adjacent: shared categories and similar text

Linked in “Criticism and challenges”
AT&T
American telecommunications company
AT&T Inc., an abbreviation of its predecessor's original name, the American Telephone and Telegraph Company, is an American multinational telecommunications holding company headquartered at the Whitacre Tower in Downtown Dallas, Texas.
60 min readGo deeper
Linked in “Criticism and challenges”
Push email
Email system
Push email is an email system that provides an always-on capability, in which when new email arrives at the mail delivery agent (MDA) (commonly called mail server), it is immediately, actively…
5 min readGo deeper
Linked in “Criticism and challenges”
T-Mobile US
American telecommunications company
T-Mobile US, Inc. is an American wireless network operator headquartered in Bellevue, Washington. Its majority shareholder and namesake is the German telecommunications company Deutsche Telekom.
71 min readGo deeper
Shares category “Computer network security”
Intrusion detection system
Network protection device or software
An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations.
17 min readGo deeper