Software inside the Netfilter framework enables packet filtering, network address [and port] translation (NA[P]T) and other packet mangling. Netfilter is a set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack.