Raw filters are used to identify traffic at which stage?

• A. After connection tracking
• B. Before connection tracking
• C. During NAT
• D. During firewall filtering

Answer: (B)

Raw filters in RouterOS are evaluated before the connection tracking engine runs. This stage is used to identify traffic prior to any connection state being created, so you can drop or bypass traffic without starting a connection-tracking entry. That pre-CT position is what makes raw rules ideal for stateless decisions or for bypassing tracking to improve performance. NAT and the normal firewall filtering happen later in the processing path after connection tracking has taken place, so they don’t occur at this pre-CT stage.