Stateful filters keep a "list" of already established connections, and if the connection is being established, what step of the TCP handshake we are on (SYN, SYN ACK etc.). Stateful is supposed better at detecting faked packets.

Stateless filters don't keep a list. Every packet is processed in isolation, with no regard to the previous packets. Stateless is supposed to be better for processing packets faster.

How do they process UDP connections? I read somewhere that stateless filters can either be set up to block all UDP connections or let all of them through, which could be a major security flaw.

Can someone please tell me the major differences between the two?

1 Answer 1


You are right about the difference between stateful and stateless filters. As for UDP packets: this fully depends on the filter rules, i.e. they might be blocked or let thru depending on the rules.

But stateful firewalls also keep a state for the seemingly stateless UDP protocol: this state is only based on source and destination IP address and port and will time out after a while since UDP does not contain an explicit connection start and end. This state makes it possible to associate incoming UDP packets with outgoing packets and thus let incoming packets belonging to an outgoing state through. An example for this are outgoing DNS queries followed by the incoming DNS reply: a stateful packet filter can require incoming UDP packets to match outgoing packets while a stateless filter has no such information and thus cannot do such granular filtering.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .