In general, a global socket filter is small program installed on your computer that - when enabled - is able to inspect and edit any socket network data sent and received by programs on your computer.
Socket network data includes communication on your local network and on the Internet - almost all ordinary programs uses socket networking.
The program can chose to do almost anything with the data that flows through it. It can change data that you receive from for example the Internet before it reaches an application, and it can modify data that applications tries to send to the network. All without that application knowing about it.
It is also possible for a socket filter to never modify incoming and outgoing data - but instead just read the data that is passed through it. That can be either something simple like a filter that counts up your network usage in terms of types - or it can be something malicious like waiting for a specific time and then sending copies of your data to a foreign state.
In this specific case, the Cisco claims that their AnyConnect socket filter performs the following three tasks:
- DNS proxying
- App/transparent proxying
- Content filtering
As far as I understand from this document, the DNS proxying feature is meant to ensure that all DNS requests from your computer are routed through the VPN. Any attempts to do DNS lookups from outside the VPN tunnel are blocked.
App/transparent proxying means that when programs on your computer try to communicate with the network, the data they try to send (not the fully network packets) are routed through a proxy server on the other side of the VPN. This essentially allows the VPN server and its proxy server to do various kinds of filtering, blocking, etc.
Content filtering means that data you send and/or receive can be filtered. For example the VPN administrator might decide that any access to facebook.com should be blocked when using the VPN.