A form of filtering in which packets from one machine to the outside world have their headers rewritten so that they appear to come from an intermediate machine. That intermediate machine then passes responses back to the originating machine. The net effect is that an entire network of machines can appear to use a single IP number, that of the masquerading host, for the purpose of outgoing connections.