In computing, a stateful firewall (any firewall that performs stateful packet inspection (SPI) or stateful inspection) is a firewall that keeps track of the state of network connections (such as TCP streams, UDP communication) travelling across it. The firewall is programmed to distinguish legitimate packets for different types of connections. Only packets matching a known connection state will be allowed by the firewall; others will be rejected. For the formal concept of computation, see computation. ... This article is about the network security device. ... The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ... User Datagram Protocol (UDP) is one of the core protocols of the Internet protocol suite. ...

Early attempts at producing firewalls operated at the application level of the seven-layer OSI model but this required too much CPU speed. Packet filters operate at the network layer (layer-3) and function more efficiently because they only look at the header part of a packet. However, pure packet filters have no concept of state as defined by computer science using the term finite state machine and are subject to spoofing attacks and other exploits. The Open Systems Interconnection Reference Model (OSI Model or OSI Reference Model for short) is a layered abstract description for communications and computer network protocol design, developed as part of the Open Systems Interconnect initiative. ... Packet filters are host-based or appliance-based applications, which block or allow network traffic based on a set of rules defined by the administrator. ... In information technology, Header refers to supplemental data placed at the beginning of a block of data being stored or transmitted, which contain information for the handling of the data block. ... In information technology, a packet is a formatted block of data carried by a packet mode computer network. ... Computer science, or computing science, is the study of the theoretical foundations of information and computation and their implementation and application in computer systems. ... Fig. ... In the context of network security, a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage. ... An exploit is a common term in the computer security community to refer to a piece of software that takes advantage of a bug, glitch or vulnerability, leading to privilege escalation or denial of service on a computer system. ...

History

Before the advent of stateful firewalls, a stateless firewall, a firewall that treats each network frame (or packet) in isolation, was normal. Such a firewall has no way of knowing if any given packet is part of an existing connection, is trying to establish a new connection, or is just a rogue packet. Modern firewalls are connection-aware (or state-aware), affording network administrators finer-grained control of network traffic. This article is about the network security device. ... In telecommunications, a frame is a packet which has been encoded for transmission over a particular link. ... In information technology, a packet is a formatted block of data carried by a packet mode computer network. ...

The classic example is the File Transfer Protocol, because by design it opens new connections to arbitrary ports. FTP, among other protocols, needs to be able to open connections to arbitrary high ports to function properly. Since a firewall has no way of knowing that the packet destined to the protected network, to some host's port 4970, is part of a legitimate FTP session, it will drop the packet. Stateful firewalls solve this problem by maintaining a table of open connections and intelligently associating new connection requests with existing legitimate connections. This article is about the File Transfer Protocol standardised by the IETF. For other file transfer protocols, see File transfer protocol (disambiguation). ...

Description

A stateful firewall is able to hold in memory significant attributes of each connection, from start to finish. These attributes, which are collectively known as the state of the connection, may include such details as the IP addresses and ports involved in the connection and the sequence numbers of the packets traversing the connection. The most CPU intensive checking is performed at the time of setup of the connection. All packets after that (for that session) are processed rapidly because it is simple and fast to determine whether it belongs to an existing, pre-screened session. Once the session has ended, its entry in the state-table is discarded.

The stateful firewall depends on the famous three-way handshake of the TCP protocol. When a client initiates a new connection, it sends a packet with the SYN bit set in the packet header. All packets with the SYN bit set are considered by the firewall as NEW connections. If the service which the client has requested is available on the server, the service will reply to the SYN packet with a packet in which both the SYN and the ACK bit are set. The client will then respond with a packet in which only the ACK bit is set, and the connection will enter the ESTABLISHED state. Such a firewall will pass all outgoing packets through but will only allow incoming packets if they are part of an ESTABLISHED connection, ensuring that hackers cannot start unsolicited connections with the protected machine. In information technology, a packet is a formatted block of data carried by a packet mode computer network. ... In information technology, Header refers to supplemental data placed at the beginning of a block of data being stored or transmitted, which contain information for the handling of the data block. ... For other uses, see Black hat (disambiguation). ...

In order to prevent the state table from filling up, sessions will time out if no traffic has passed for a certain period. These stale connections are removed from the state table. Many applications therefore send keepalive messages periodically in order to stop a firewall from dropping the connection during periods of no user-activity, though some firewalls can be instructed to send these messages for applications. It is worth noting that the most common Denial of Service attack on the internet these days is the SYN flood, where a malicious user intentionally sends large amounts of SYN packets to the server in order to overflow its state table, thus blocking the server from accepting other connections.^{[citation needed]} Keepalive is a message sent by one device to another to check that the link between the two is operating. ... DoS redirects here. ... A normal connection between a user (Alice) and a server. ...

Many stateful firewalls are able to track the state of flows in connectionless protocols, like UDP. Such sessions usually get the ESTABLISHED state immediately after the first packet is seen by the firewall. Sessions in connectionless protocols can only end by time-out.

By keeping track of the connection state, stateful firewalls provide added efficiency in terms of packet inspection. This is because for existing connections the firewall need only check the state table, instead of checking the packet against the firewall's rule set, which can be extensive. There is also an additional cost when the firewall's rule set is updated, which should cause the state table to be flushed. Also, the concept of deep packet inspection is unrelated to stateful firewalls^[clarify] / here the user data in the packet are inspected and as such it is application layer firewall / Deep packet inspection (DPI) is a form of computer network packet filtering that examines the data part of a through-passing packet, searching for non-protocol compliance or predefined criteria to decide if the packet can pass. ...

Application-level filters

However, packet filtering alone is not regarded as providing enough protection. In order to effectively block peer-to-peer-related network traffic, what is needed is a firewall that does application filtering, which can be regarded as an extension to stateful packet inspection. Stateful packet inspection can determine what type of protocol is being sent over each port, but application-level filters look at what a protocol is being used for. For example, an application-level filter might be able to tell the difference between HTTP traffic used to access a Web page and HTTP traffic used for file sharing, whereas a firewall that is only performing packet filtering would treat all HTTP traffic equally. A peer-to-peer (or P2P) computer network is a network that relies on the computing power and bandwidth of the participants in the network rather than concentrating it in a relatively few servers. ...

Application-layer firewalls differ from stateful packet-filtering and circuit-level gateways in several ways. Application-layer firewalls support multiple application proxies on a single firewall. The proxies sit between the client and server, passing data between the two endpoints. Suspicious data is dropped and the client and server never communicate directly with each other. Because application-level proxies are application-aware, the proxies can more easily handle complex protocols like H.323, which is used for videoconferencing and VoIP (voice over IP). Application proxies can be transparent to the client and server, as no configuration is required on the client or the server; or can be nontransparent, letting the client and server address the proxy server directly. Transparency versus non transparency is a matter of implementation and address hiding, rather than about security. Look up proxy in Wiktionary, the free dictionary. ... H.323 is an umbrella recommendation from the ITU-T, that defines the protocols to provide audio-visual communication sessions on any packet network. ... IP Telephony, also called Internet telephony, is the technology that makes it possible to have a telephone conversation over the Internet or a dedicated Internet Protocol (IP) network instead of dedicated voice transmission lines. ...

Pitfalls

Microsoft's latest operating system, Windows Vista, uses TCP window scaling for non-http (web) connections. So do Linux kernels from versions 2.6.8 on. This behavior is incompatible with some firewalls that use SPI (Stateful Packet Inspection) as found in routers like the Checkpoint NG R55, Cisco PIX IOS earlier than v6.3.1, NetApp Cache Appliances, SonicWall, D-Link DI-724U, Netgear WGR614, and Linksys WRT54GS. ^[1] This may be related to previous failures to work properly. Pre-released (beta) versions of Vista allegedly had more problems, including failed http (web) connections through SPI firewalls.^[2] Windows Vista is a line of graphical operating systems used on personal computers, including home and business desktops, notebook computers, Tablet PCs, and media centers. ... The TCP window scale option is an option to increase the TCP congestion window size above its maximum value of 65,536 bytes. ... HTTP (for HyperText Transfer Protocol) is the primary method used to convey information on the World Wide Web. ... This article is about the network security device. ... Cisco may refer to: Cisco Systems, a computer networking company Cisco IOS, an internet router operating system CISCO Security Private Limited, a security company in Singapore Commercial and Industrial Security Corporation, a statutory board in Singapore Abbreviation for San Francisco, California Cisco (wine) The Cisco Kid, a fictional character created... Network Appliance, Inc. ... SonicWALL is a company which provides hardware devices for Internet security and unified threat management, including firewalls, VPN, backup devices and content filtering systems. ... D-Link Corporation is a Taiwanese company that manufactures wireless and Ethernet computer networking products for both consumer and SOHO users. ... NETGEAR, founded in 1996, is a manufacturer of computer networking equipment and other computer hardware. ... A 802. ... Criticism of Microsoft has followed various aspects of its products and business practices. ... Look up beta, Beta in Wiktionary, the free dictionary. ... Windows Vista is a line of graphical operating systems used on personal computers, including home and business desktops, notebook computers, Tablet PCs, and media centers. ... HTTP (for HyperText Transfer Protocol) is the primary method used to convey information on the World Wide Web. ... This article is about the network security device. ...

See also

• Network layer firewall
• Proxy server
• Cisco PIX
• FireWall-1
• Netfilter
• Iptables
• Kerio WinRoute Firewall
• CHX-I

A network layer firewall works as a packet filter by deciding what packets will pass the firewall according to rules defined by the administrator. ... In computer networks, a proxy server is a server (a computer system or an application program) which services the requests of its clients by forwarding requests to other servers. ... Pix 535 Firewall // Cisco PIX (Private Internet EXchange) is a firewall originally conceived in March 1994 by John Mayes of Redwood City, California and coded by Brantley Coiles of Athens, Georgia. ... FireWall-1 © is a firewall (networking) product created by Check Point Technologies, Ltd. ... In computer networking, netfilter, along with its companion iptables, are collectively a software extension to the Linux operating system that implements a stateful firewall framework. ... In computer networking, netfilter, along with its companion iptables, are collectively a software extension to the Linux operating system that implements a stateful firewall framework. ... Screenshot of user statistics Screenshot of web content tracking Kerio WinRoute Firewall is a software gateway firewall developed by Kerio Technologies. ...

Notes