The SurfWatch module examines the URL of every address coming toward the TCP/IP stack. It looks specifically for five types of URLs: http, nntp, ftp, gopher, and IRC. It takes each of those five types of URLs and puts it in its own separate "box." It allows the rest of the Internet information coming in to go through. SurfWatch checks for these types of URLs because they are the ones most likely to contain objectionable material.
