Walk the Stateful Decision Tree

About this interactive

A stateless firewall judges each packet on its own: it checks the packet against the policy table, the rules, and routes or discards it. To let a web page back in, it needs a rule that admits traffic from that web server, without knowing whether anyone asked for it. A stateful firewall keeps track of each conversation. When an inside PC starts a TCP handshake with a web server, the firewall records it, and the packets that fulfil that conversation are let through until it closes. Its decision tree has more branches. First, is the packet in the state table? If it is, and it is a valid next step, the right sequence and acknowledgement numbers and the natural flow of that conversation, it is routed and the table updated, for instance closed when the conversation ends. If it is in the table but does not fit, it is discarded: something may be tampering with the conversation. If it is not in the table, is it a request for a new connection? A conversation cannot start in the middle, so a packet that is neither is discarded. A genuine new request goes to the policy table, which permits it, routing it and adding it to the state table, or discards it.

What you'll learn

Follow a stateful firewall's decision tree for a packet: routed because it fits a tracked conversation, sent to the policy table because it is a new connection request, or discarded because it is neither
Contrast this with a stateless firewall, which checks every packet against the policy table alone and so cannot tell a reply from an unsolicited packet

Aligned to

CompTIA Security+

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

4.5 Given a scenario, modify enterprise capabilities to enhance security.

Key terms

Stateful Firewall: A firewall that tracks the state of active network connections and makes filtering decisions based on context.
State Table: A data structure maintained by a stateful firewall that records active connection information, including connection status and expected next steps, to evaluate whether packets belong to a legitimate session.
Stateless Firewall: A firewall that filters packets based solely on static rules without tracking connection state.
Stateful Packet Inspection: A firewall method that tracks the state of active connections and uses that context to determine whether inbound packets belong to a legitimate outbound session.

Topics

Stateful Firewall Stateless Firewall State Table Stateful Packet Inspection Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →