Stateful Firewall
Definition
A firewall that tracks the state of TCP connections in a connection table and permits return traffic of an established flow without re-evaluating ACLs. Standard since the 1990s; the baseline for any production perimeter.
- Tracks
- State of TCP connections in a connection table
- Behaviour
- Permits return traffic of an established flow without re-checking ACLs
- Adoption era
- Standard since the 1990s
- Role
- Baseline for any production network perimeter
Common questions
How does a stateful firewall differ from a simple stateless packet filter?+
A stateless filter evaluates every packet independently against its access control list, while a stateful firewall remembers established connections in a state table and automatically allows their return traffic, which is both faster and closer to how real network sessions behave.
What forensic value does a stateful firewall's connection table have during an incident investigation?+
Logs of the connection table can show which sessions were active, when they were established, and which were dropped, helping reconstruct the sequence of network activity around an intrusion even if full packet capture was not running.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- IDS vs IPS
- An intrusion detection system observes copied traffic and alerts. An intrusion prevention system sits inline on the data path and blocks. Snort...
- IPSec AH and ESP
- Authentication Header provides integrity and origin authentication only. Encapsulating Security Payload provides confidentiality plus optional integrity. Almost all modern IPSec deployments use...
- Kerberos
- An MIT-designed authentication protocol using a Key Distribution Centre, ticket-granting tickets and service tickets. The backbone of Active Directory authentication. Replay-protected via...
- NGFW
- Next-generation firewall: stateful packet inspection plus application identification, integrated IPS, TLS inspection and user-identity awareness. Palo Alto, Fortinet, Check Point and Cisco...