What it is
Every Minecraft connection opens with a handshake packet containing the protocol version number, the server address the client was given, the port, and a next-state field saying whether this connection is a status ping or a login attempt. It arrives before authentication, before the world loads, before anything is allocated on your behalf.
Why it matters for Minecraft
It is the earliest possible decision point, and it is unusually informative. The hostname field tells you what the client thinks it is connecting to — a connection asking for a hostname you do not serve is not a player who made a typo. The protocol version tells you which client build it claims to be, which is checkable against what real clients send. The next-state field separates pings from joins, which have completely different cost profiles.
What a filter does with it
Reads it, rather than counting it. Hostname is matched against what you actually serve, version against your whitelist, and the connection is scored before a login is ever processed. A generic filter cannot do any of this because it does not know the packet format — it sees bytes on port 25565. That distinction is the whole of protocol-aware filtering.
Common questions
Can the handshake be faked?+
The fields can be set to anything, and good bots set them plausibly — that is exactly why the handshake alone is not a verdict. It is the first input to scoring, not the last. Consistency between claimed version and observed behaviour is harder to fake than the claim itself.
Why does the handshake include the hostname?+
So one server address can host many virtual hosts, the same idea as HTTP's Host header. For protection it is a gift: it makes hostname-based routing and filtering possible before a connection costs anything.