What is stateful inspection in firewall filtering?

What is stateful inspection in firewall filtering?

• A. It blocks all traffic by default.
• B. It inspects only the headers, not payload.
• C. It is equivalent to static packet filtering.
• D. It allows only established connections into the network.

Answer: (D)

Stateful inspection is a firewall approach that watches the context of traffic over time by keeping a running record of active connections in a state table. Instead of judging each packet in isolation, the firewall checks whether a packet belongs to an existing, allowed connection or if it’s part of a new connection that should be dropped unless an explicit rule allows it. This means inbound traffic is often permitted only if it’s part of an established session or a valid response to a request from inside. This is why the correct idea is that only established connections are allowed into the network. It’s different from simply blocking everything by default or from inspecting only headers without regard to connection state. It also isn’t the same as static packet filtering, which doesn’t track connection state.

Stateful inspection is a firewall approach that watches the context of traffic over time by keeping a running record of active connections in a state table. Instead of judging each packet in isolation, the firewall checks whether a packet belongs to an existing, allowed connection or if it’s part of a new connection that should be dropped unless an explicit rule allows it. This means inbound traffic is often permitted only if it’s part of an established session or a valid response to a request from inside.

This is why the correct idea is that only established connections are allowed into the network. It’s different from simply blocking everything by default or from inspecting only headers without regard to connection state. It also isn’t the same as static packet filtering, which doesn’t track connection state.