What Is Stateful Inspection?

Stateful inspection is a type of packet filtering that helps control data. If you've ever had to buy a new car, you know the feeling of being stuck in the dealer's office for hours, trying to remember what color you wanted. It's like that when you're trying to get through a firewall. Stateful inspection uses a database to keep track of every packet that comes through your firewall. It knows who sent them and whom they were meant for. It knows if they were allowed or not; if they were allowed, it knows what kind of information can pass through next time. It differs from stateless inspection, which looks at one packet at a time (like a car salesman).ackets move through a firewall. It does this by keeping track of the state of each box as it passes through the firewall and only allowing certain packets to give based on the previous package. For example, if you're trying to send an email from your computer, your network administrator has blocked all outgoing mail. The stateful inspection will keep track of this fact and only allow the message to be sent once they're sure it's allowed. Stateful inspection is the only way to go. Static packet filtering was all the rage, but it's so 2015. It's time for you to move on and embrace stateful inspection. The stateful inspection looks at application state information, which means it can determine whether a packet is an initial message or a response. That's an important distinction because you need to do that to know what kind of traffic you're letting in, which can be dangerous! With stateful inspection, you also get better performance because it doesn't have to keep going back and forth between the packet header and IP address (which happens in static packet filtering). You can look at the actual application data and decide based on that.