Stateful Packet Filter structure

Question

http://postimg.org/image/o1ojanqq3/

For stateful packet filter,

Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter?

Secondly, how can stateful packet filter monitor the track of connection?

Answer 1

First, let's define both what a non-stateful and a stateful firewall or filter is:

Non-stateful firewall: This was the original firewall method. You give the firewall rules as to which IP ports are open or not. If an incoming packet (usually from the internet) doesn't specify a port allowed by the rules, it is dropped/stopped by the firewall.

Stateful firewall: All ports are blocked by the firewall (by default, and this only applies to traffic from the outside/internet). When a computer behind/inside the firewall wants to establish a connection through the firewall, the firewall watches the first packet go out (on whatever port your computer selects) to a remote (web) computer. The firewall remembers the IP address where the packet was sent to and what port was used by the sending/internal computer, and will (for a limited time) allow packets from that external IP address that use that port) to pass through the firewall to reach the internal network. Stateful in this case means the filtering state (rules) of the firewall depend on what traffic has been initiated by computers on the internal (nominally safe) side of the firewall. By default, any packets from the outside are stopped by the firewall unless they are part of a current ongoing conversation initiated by the internal computer.

Both of the above only require looking at ingoing and outgoing packet headers, which include the sending and addressed IPs (from and to addresses) as well as the IP port.

Later on, firewalls also started doing "deep packet inspection" where they looked at the contents of the packets as well.

If I understand your question, you are asking about the ability of a firewall to know what application is trying to connect through the firewall.

A lot of applications use certain default ports. For example, HTTP (web pages) use port 80, while HTTPS (secure/encrypted web pages) use port 443. So just looking at the port used tells the firewall what application is probably being used. As the internet moves more and more to encrypted communication (HTTPS everywhere and the use of VPN or other encrypted communication links), firewalls are less and less able to look into the contents of IP traffice, so seeing IP port will over time become the only way the firewall can tell what application is communicating. There are ways to allow a sophisticated firewall to look into encrypted packets, but normally they will only be employed by large organizations (and some snoopy ISPs) but not by home users.

Answer 2

Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter?

Application level analysis is important to filter out malware because you have to understand the applications protocol to actually extract potential malware for analysis.

But, this is of course only a disadvantage compared to an application level gateway/proxy. A (non-stateful) packet filter cannot see application data either.

Secondly, how can stateful packet filter monitor the track of connection?

TCP connections are defined by source/destionation IP and port but also by sequence numbers etc. A TCP connection has a start and end end which are signaled with SYN, FIN flags. By having an internal table of the status for each connection the stateful packet filter can keep track of these connections. This way it can for instance be used to make sure that packets from outside get only passed inside if they match an existing connection which got established from inside to outside.