Editing Internet filter (section)

==Products and services==
{{See also|List of content-control software|Category:Content-control software}}
Some ISPs offer [[parental control]] options. Some offer security software which includes parental controls. [[Mac OS X v10.4]] offers parental controls for several applications ([[Mail (OS X)|Mail]], [[Macintosh Finder|Finder]], [[iChat]], [[Safari (web browser)|Safari]] & [[Dictionary (software)|Dictionary]]). Microsoft's [[Windows Vista]] operating system also includes content-control software.

Content filtering technology exists in two major forms: [[Application-level gateway|application gateway]] or [[Deep packet inspection|packet inspection]]. For HTTP access the application gateway is called a [[web-proxy]] or just a proxy. Such web-proxies can inspect both the initial request and the returned web page using arbitrarily complex rules and will not return any part of the page to the requester until a decision is made. In addition they can make substitutions in whole or for any part of the returned result. Packet inspection filters do not initially interfere with the connection to the server but inspect the data in the connection as it goes past, at some point the filter may decide that the connection is to be filtered and it will then disconnect it by injecting a TCP-Reset or similar faked packet. The two techniques can be used together with the packet filter monitoring a link until it sees an HTTP connection starting to an IP address that has content that needs filtering. The packet filter then redirects the connection to the web-proxy which can perform detailed filtering on the website without having to pass through all unfiltered connections. This combination is [[Cleanfeed (content blocking system)|quite popular]] because it can significantly reduce the cost of the system.

There are constraints to IP level packet-filtering, as it may result in rendering all web content associated with a particular IP address inaccessible. This may result in the unintentional blocking of legitimate sites that share the same IP address or domain. For instance, university websites commonly employ multiple domains under one [[IP address]]. Moreover, IP level packet-filtering can be surpassed by using a distinct IP address for certain content while still being linked to the same domain or server.<ref>{{Cite journal |title=Internet filtering - Issues and challenges  |url=https://ieeexplore.ieee.org/document/5523867 |access-date=2024-02-02 |journal=IEEE Security & Privacy|date=2010 |doi=10.1109/MSP.2010.131 |last1=Varadharajan |first1=Vijay |volume=8 |issue=4 |pages=62–65 }}</ref>

Gateway-based content control software may be more difficult to bypass than desktop software as the user does not have physical access to the filtering device. However, many of the techniques in the [[Content-control software#Bypassing filters|Bypassing filters]] section still work.