<!doctypehtml><meta content=IE=Edge http-equiv=X-UA-Compatible><meta content=320 name=MobileOptimized><meta content=width=device-width,initial-scale=1.0 name=viewport><meta content="text/html; charset=utf-8"http-equiv=Content-Type><title>
   Stateful firewall explained
  </title><link href=../explained.today.css?v=1 rel=stylesheet><meta content="firewall, tcp, udp, 2020, state, connection, icmp, sep, session, site, web, web site, network, stateful, table, through"name=keywords><meta content="What is Stateful firewall? Stateful firewall is a network-based firewall that individually tracks sessions of network connections traversing it."name=description><script>(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');ga('create', 'UA-101684966-1', 'auto');ga('send', 'pageview');</script><link href=https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css rel=stylesheet><script async src=//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js></script><script>(adsbygoogle = window.adsbygoogle || []).push({  google_ad_client: "ca-pub-5994403859070052",  enable_page_level_ads: true });</script><body><div class=Header><div class=BreadCrumb><ul><li class=First>You are here<li><a href=http://everything.explained.today> Everything </a> <a href=http://explained.today> Explained.Today </a><li><a href=../contents/list.htm> A-Z Contents </a><li><a href=../contents/list_S.htm> S </a><li><a href=../contents/list_ST.htm> ST </a><li><a href=../contents/list_STA.htm> STA </a><li><a href=../contents/list_STAT.htm> STAT </a><li><a href=../contents/list_STATE.htm> STATE </a><li>Stateful firewall</ul></div></div><div class=SideBar><p class=logo><img alt="Explained Today"title="The Information and Knowledge Portal"height=125px src=../images/brain.gif width=200px><form action=http://www.google.com/cse id=cse-search-box target=_blank><div><input name=cx type=hidden value=partner-pub-5994403859070052:sf3q7o-pgfc><input name=ie type=hidden value=UTF-8><input name=q size=24><input name=sa type=submit value=Search></div></form><script src=http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en></script><p> <div class=HideIfFull><script async src=//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js></script><ins class=adsbygoogle data-ad-client=ca-pub-5994403859070052 data-ad-format=auto data-ad-slot=6382878523 style=display:block> </ins><script>(adsbygoogle = window.adsbygoogle || []).push({});</script></div></div><div class=HeaderBar><script async src=//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js></script><ins class=adsbygoogle data-ad-client=ca-pub-5994403859070052 data-ad-format=auto data-ad-slot=4896110924 style=display:block> </ins><script>(adsbygoogle = window.adsbygoogle || []).push({});</script></div><div class=Body><h1>Stateful firewall explained</h1><p>In computing, a <b> stateful firewall </b> is a <a title="Firewall is a network security system that monitors and controls incoming and outgoing network traffic based on ..."href=../Firewall_(computing)/> network-based firewall </a> that individually tracks sessions of network connections traversing it. <b> Stateful packet inspection </b> , also referred to as dynamic packet filtering, <sup> <a href=#Ref-1> [1] </a> </sup> is a security feature often used in non-commercial and business networks.<h2>Description</h2><p>A stateful firewall keeps track of the state of network connections, such as <a title="The Transmission Control Protocol is one of the main protocol s of the Internet protocol suite."href=../Transmission_Control_Protocol/> TCP </a> streams, <a title="User Datagram Protocol is one of the core members of the Internet protocol suite."href=../User_Datagram_Protocol/> UDP </a> datagrams, and <a title="The Internet Control Message Protocol is a supporting protocol in the Internet protocol suite."href=../Internet_Control_Message_Protocol/> ICMP </a> messages, and can apply labels such as <i> LISTEN </i> , <i> ESTABLISHED </i> , or <i> CLOSING </i> . <sup> <a href=#Ref-2> [2] </a> </sup> State table entries are created for TCP streams or UDP datagrams that are allowed to communicate through the firewall in accordance with the configured security policy. Once in the table, all <i> RELATED </i> packets of a stored session are streamlined allowed, taking less <a title="A central processing unit is the electronic circuit ry that executes instructions comprising a computer program."href=../CPU/> CPU </a> cycles than standard inspection. Related packets are also permitted to return through the firewall even if no rule is configured to allow communications from that host. If no traffic is seen for a specified time (implementation dependent), the connection is removed from the state table. Applications can send <a title="A keepalive is a message sent by one device to another to check that the link between the two is operating, or to prevent ..."href=../keepalive/> keepalive </a> messages <sup> <a href=#Ref-3> [3] </a> </sup> periodically to prevent a firewall from dropping the connection during periods of no activity or for applications which by design have long periods of silence.<p>The method of maintaining a session's state depends on the <a title="Transport layer is a conceptual division of methods in the layered architecture of protocols in the network stack in the ..."href=../Transport_layer/> transport </a> protocol being used. TCP is a connection oriented protocol <sup> <a href=#Ref-4> [4] </a> </sup> and sessions are established with a three-way handshake using <i> SYN </i> packets and ended by sending a <i> FIN </i> notification. <sup> <a href=#Ref-5> [5] </a> </sup> The firewall can use these unique connection identifiers to know when to remove a session from the state table without waiting for a timeout. UDP is a connectionless protocol, <sup> <a href=#Ref-4> [4] </a> </sup> which means it does not send unique connection related identifiers while communicating. Because of that, a session will only be removed from the state table after the configured time-out. <a title="UDP hole punching is a commonly used technique employed in network address translation applications for maintaining User ..."href=../UDP_hole_punching/> UDP hole punching </a> is a technology that abuses this trait to allow for dynamically setting up data tunnels over the internet. <sup> <a href=#Ref-6> [6] </a> </sup> ICMP messages are distinct from TCP and UDP and communicate control information of the network itself. A well known example of this is the <a title="Ping is a computer network administration software utility used to test the reachability of a host on an Internet Protocol ..."href=../Ping_(networking_utility)/> ping </a> utility. <sup> <a href=#Ref-7> [7] </a> </sup> ICMP responses will be allowed back through the firewall. In some scenarios, UDP communication can use ICMP to provide information about the state of the session so ICMP responses related to a UDP session will also be allowed back through.<h2>See also</h2><ul><li><a title="Computer security is the protection of computer system s and networks from information disclosure, theft of or damage to ..."href=../Computer_security/> Computer security </a><li><a title="Netfilter is a framework provided by the Linux kernel that allows various networking -related operations to be implemented ..."href=../Netfilter/> Netfilter </a></ul><h2>Notes and References</h2><ol><li><a name=Ref-1> </a> Book: Goralski, Walter, author.. <a href=http://worldcat.org/oclc/986540207 rel=nofollow> The illustrated network : how TCP/IP works in a modern network </a> . 978-0-12-811027-0. 986540207.<li><a name=Ref-2> </a> Web site: <a href=https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.halu101/constatus.htm rel=nofollow> TCP connection status </a> . Sep 6, 2020. IBM Knowledge Center.<li><a name=Ref-3> </a> Web site: <a href=https://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html rel=nofollow> TCP Keepalive HOWTO </a> . Sep 6, 2020. The Linux Documentation Project.<li><a name=Ref-4> </a> Web site: Mitchell. Bradley. Apr 1, 2020. <a href=https://www.lifewire.com/tcp-headers-and-udp-headers-explained-817970 rel=nofollow> TCP vs UDP </a> . Sep 6, 2020. Lifewire.<li><a name=Ref-5> </a> Web site: <a href=https://study-ccna.com/tcp-three-way-handshake/ rel=nofollow> TCP three-way handshake </a> . Sep 6, 2020. Study-CCNA.<li><a name=Ref-6> </a> Web site: <a href=https://documentation.meraki.com/MX/Site-to-site_VPN/Automatic_NAT_Traversal_for_Auto_VPN_Tunneling_between_Cisco_Meraki_Peers rel=nofollow> Automatic NAT Traversal for Auto VPN Tunneling between Cisco Meraki Peers </a> . Sep 6, 2020. Meraki.<li><a name=Ref-7> </a> Web site: Mitchell. Bradley. Dec 3, 2018. <a href=https://www.lifewire.com/icmp-and-icmpv6-ip-networking-818135 rel=nofollow> Guide to Internet Control Message Protocol (ICMP) </a> . Sep 6, 2020. Lifewire.</ol><div class=Footer><div class=robots-noindex><p>This article is licensed under the <a href=http://www.gnu.org/copyleft/fdl.html rel=nofollow> GNU Free Documentation License </a> . It uses material from the Wikipedia article " <a href=http://en.wikipedia.org/wiki/Stateful_firewall rel=nofollow> Stateful firewall </a> ".</div><p>Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2021, A B Cryer, All Rights Reserved. <a href=http://explained.today/cookie_policy.htm> Cookie policy </a> .</div></div><script data-cfasync=false src=https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js></script><script>window.cookieconsent.initialise({  "palette": {    "popup": {      "background": "#000"    },    "button": {      "background": "#f1d600"    }  },  "content": {    "href": "explained.today/cookie_policy.htm"  }});</script>