What is the purpose of Raw filters?

• A. Identify the traffic after connection tracking
• B. Identify the traffic before connection tracking
• C. Block traffic by IP
• D. Log traffic

Answer: (B)

Raw filters run at the earliest stage of the firewall processing, before MikroTik’s connection tracking engine sees the traffic. Their purpose is to identify traffic before connection tracking happens. By matching here, you can decide to treat certain traffic differently right away, such as bypassing connection tracking for that traffic (using the notrack action) to save CPU and memory, or to set up rules that apply before any stateful inspection. This is especially useful for high-volume flows or traffic that doesn’t need state tracking, or when you want to avoid conntrack issues for specific protocols. In contrast, filtering or logging rules applied later in the path work with the connection-tracked state, so they aren’t suitable for pre-conntrack decisions.