What is an application level firewall, and how does it work differently from a plain network firewall?

A group of gateways whose focus is protection. Built on a proxy or reverse proxy, it breaks the connection between client and server and examines not only the connection data (up to OSI layer 3) but also the content of the payload (from OSI layer 4 upward). Because that content differs strongly between applications, each communication protocol needs its own gateway with matching controls.

* The network firewall stops at the connection data; the application level firewall terminates the connection and reads what is inside. *

Breaking the connection is the essential trick. A packet filter forwards packets it has judged by their headers; an application level firewall accepts the client's connection itself, reads and checks the full request, and only then opens its own connection to the server (or not). That is what lets it see an SQL fragment in a form field or a script in a parameter.

The price is specialisation: understanding the payload means understanding the protocol. An HTTP gateway cannot judge an SMTP conversation or an SAP protocol, which is why application level firewalls exist per protocol, and why the most common kind, specialised for HTTP, got its own name. (General references often place application firewalls at OSI layer 7; the point is the same: they judge the content, not just the addresses.)

Go deeper:

• Application firewall — Wikipedia — network-based and host-based application firewalls and their history.
• OSI model — Wikipedia — the layers a network firewall and an application firewall look at.