SnabbWall is a modular, application-level (Layer-7) firewall suite for Snabb.

As a modular system, it provides a set of components which can be reused in other Snabb designs.

As an application-level (Layer-7) firewall, it is able to:

As a suite, it includes a complete firewall program out of the box.


SnabbWall takes advantage of the separation in functional components, called applications in Snabb jargon. The following diagram contains a simplified view of the system:

Building blocks

Building blocks

The main components are L7 Spy and L7 Firewall, both are Snabb applications:


L7 Spy

L7 Spy application

L7 Spy application

The L7 Spy (L7spy) application receives packets from another Snabb application as input, analyzes the packets it receives, and places them unchanged in the output. As a by-product of analyzing the packets, it may generate metadata indicating the kind of application and data payload that the packet contains. This metadata is de-coupled from the original packet data —which remains unchanged— and can be consumed by other Snabb applications-

Each instance of the L7spy application maintain an internal state which is updated as each packet is scanned. It contains information about previously inspected packets which is used to further improve identification of packets in the future. The state is detached from the L7fw application and two (or more) instances can share the same state:

Using a shared L7 Spy state

Using a shared L7 Spy state

The main use case for a the shared state is correlating traffic which belongs to the same application flowing in both “send” and “receive” directions.

L7 Firewall

L7 Firewall application

L7 Firewall application

The L7 Firewall (L7fw) application receives packets from another Snabb application as input, applies a set of packet filtering rules, and either drops, rehects, or accepts the packet.

Note that the application by itself is unidirectional. While this may seem counterintuitive, allows for greater flexibility:


The SnabbWall suite ships with a ready to use program which uses the L7 Spy and L7 Firewall applications to implement a Layer-7 stateful firewall.

This application, runnable using the snabb wall command, includes support for the following features: