The firewall can't tell what is legitimate traffic and what looks like legitimate traffic, but the application often can. This is what DOTS us trying to cover:

The firewall can't tell what is legitimate traffic and what looks like legitimate traffic, but the application often can. This is what DOTS us trying to cover: let the application server tell the firewall who to allow or block in real time. https://www.rfc-editor.org/rfc/rfc8782.html https://www.rfc-editor.org/rfc/rfc8782.html