For the "application-level stateful firewall", I mean:

  • the firewall inspects the application-layer payload (e.g. deep packet inspection), memorize the status using some parameters, and store it in the firewall

  • the status will be compared between upcoming packet and stored historical packets

My question is:

I want to find more literature about limitation on the max number of packets to be inspected and memorized (status), and the impact on network performance, for such application-level stateful firewall.

1 Answer 1


First, an application-level firewall is usually always stateful, unless you deal with application protocols where each packet can be analyzed separate from the rest. Therefore one only distinguishes between stateful and stateless analysis with packet filter firewalls but not with application-level firewalls.

The number of packets the firewall can process, the impact it has on the network performance (i.e. throughput and latency) and the limitations in processing depend on a lot of factors, like the complexity of the application protocol to be analyzed, the quality and depth of the analysis and the performance of the underlying hardware and operating system. This means no hard numbers are possible. But in general: the more effort is put into a proper analysis of the protocol the slower it gets but the more secure it gets too. And one can try to make it faster by throwing more expensive hardware on it, i.e. the classical trade-off between performance, price and security.

Unfortunately most vendors and literature only talk about performance and maybe price and not about how deep and solid the application analysis really is and what level of security it really provides. Thus you might have a look at the white papers and sales brochures of the various vendors for some performance numbers but keep in mind that performance and price are only one aspect and that a major aspect of a firewall should be the security it really provides and not the one which is claimed (which is usually "full protection", but the cheaper the firewall the higher is the chance of dubious claims).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .