What is a stateful packet filtering firewall

A little knowledge every day accompanies you to stay up late:

Stateful packet filtering Firewall:

Definition: the mainstream technology of hardware firewalls to maintain state table items for traversing TCP and UDP flows.

Basically every firewall manufacturer has the function of stateful packet filtering, such as checkpoint netscreen,ASA and so on.

Features:

* maintain stateful session flow table (stateful table entries) for each TCP and UDP flow

* the returned packet first queries the status table entry. If it is part of the previous connection, even if it is rejected by ACL, it can pass through the firewall and release all of it.

* stateful table item maintenance: TCP source destination port, source destination IP, serial number, flag bit (this is also the part of the stateful table entry)

(flag bit: mainly SYN ACK RST FIN SYN ACK is the package needed for the main TCP to establish a connection, RST is the abnormal termination of the session, FIN is the normal termination of the session, in addition to these four packages, there are two packages, one is URG and PSH)

(serial number: TCP is a reliable transport protocol to ensure guaranteed transmission. If the transmission is successful, the serial number will be increased by 1 digit.) this ensures reliability and security.

It is mentioned here that if you want to hijack a TCP session, you need not only the source IP, the source port number, but also the serial number.

* High performance, the characteristics of hardware firewall.