For stateful packet filter,

Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter?

Secondly, how can stateful packet filter monitor the track of connection?

2 Answers 2


First, let's define both what a non-stateful and a stateful firewall or filter is:

Non-stateful firewall: This was the original firewall method. You give the firewall rules as to which IP ports are open or not. If an incoming packet (usually from the internet) doesn't specify a port allowed by the rules, it is dropped/stopped by the firewall.

Stateful firewall: All ports are blocked by the firewall (by default, and this only applies to traffic from the outside/internet). When a computer behind/inside the firewall wants to establish a connection through the firewall, the firewall watches the first packet go out (on whatever port your computer selects) to a remote (web) computer. The firewall remembers the IP address where the packet was sent to and what port was used by the sending/internal computer, and will (for a limited time) allow packets from that external IP address that use that port) to pass through the firewall to reach the internal network. Stateful in this case means the filtering state (rules) of the firewall depend on what traffic has been initiated by computers on the internal (nominally safe) side of the firewall. By default, any packets from the outside are stopped by the firewall unless they are part of a current ongoing conversation initiated by the internal computer.

Both of the above only require looking at ingoing and outgoing packet headers, which include the sending and addressed IPs (from and to addresses) as well as the IP port.

Later on, firewalls also started doing "deep packet inspection" where they looked at the contents of the packets as well.

If I understand your question, you are asking about the ability of a firewall to know what application is trying to connect through the firewall.

A lot of applications use certain default ports. For example, HTTP (web pages) use port 80, while HTTPS (secure/encrypted web pages) use port 443. So just looking at the port used tells the firewall what application is probably being used. As the internet moves more and more to encrypted communication (HTTPS everywhere and the use of VPN or other encrypted communication links), firewalls are less and less able to look into the contents of IP traffice, so seeing IP port will over time become the only way the firewall can tell what application is communicating. There are ways to allow a sophisticated firewall to look into encrypted packets, but normally they will only be employed by large organizations (and some snoopy ISPs) but not by home users.

  • Thank you for your explanation which is very good and so helpful. May I ask more? Why is it a drawback if cannot see the application data?
    – Ricky
    May 28, 2016 at 15:19
  • Sometimes you want to refuse applications. Often for example TeamViewer, Skype and stuff. But as they building up their connection via a 3rd party they use the port 80 that you can´t usually block. So you have no port to block and only a datastream. You then try to recognize the application from the datastream. If it is encrypted the only way is by short unencrypted handshakes or plain statistically from the usual transfer pattern of the application.
    – Matte
    May 28, 2016 at 19:56

Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter?

Application level analysis is important to filter out malware because you have to understand the applications protocol to actually extract potential malware for analysis.

But, this is of course only a disadvantage compared to an application level gateway/proxy. A (non-stateful) packet filter cannot see application data either.

Secondly, how can stateful packet filter monitor the track of connection?

TCP connections are defined by source/destionation IP and port but also by sequence numbers etc. A TCP connection has a start and end end which are signaled with SYN, FIN flags. By having an internal table of the status for each connection the stateful packet filter can keep track of these connections. This way it can for instance be used to make sure that packets from outside get only passed inside if they match an existing connection which got established from inside to outside.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.