A packet filtering firewall mainly works by examining the header information of packets and making forwarding or blocking decisions based on predefined rules. Its inspection is primarily focused on the network layer , where it checks information such as the source IP address , destination IP address , protocol type, and related packet header fields. Because of this, the correct answer is Network layer .

Packet filtering firewalls can also use some transport-layer information such as TCP or UDP port numbers in practical policy matching, but their fundamental classification in traditional firewall technology is based on network-layer packet filtering rather than deep inspection of application content. They do not analyze user data in the same detailed way as application-layer gateways or next-generation firewalls.

The physical layer only deals with bit transmission and hardware signaling, so it is not the layer used for packet filtering decisions. The data link layer focuses on MAC addresses and frame transmission within a local segment, while the application layer deals with application protocols such as HTTP, FTP, and DNS. Therefore, for a packet filtering firewall, the correct layer checked is the Network layer .