It creates entries in a state table for permitted communication and compares later packets with the expected addresses, ports, protocol, direction, and connection state. Matching return traffic can therefore be handled without a separate broad inbound rule.
For Transmission Control Protocol (TCP), the firewall can follow establishment, use, and termination. Connectionless protocols such as User Datagram Protocol (UDP) have no equivalent handshake, so implementations usually maintain temporary flow state and expire it after a timeout. Products vary in sequence validation, application awareness, fragment handling, and state synchronization between redundant nodes.
Key points
Policy decisionA new flow must satisfy the configured rule; subsequent packets must satisfy both policy and the state the firewall has recorded.
State operationsSize tables and timeouts for expected demand, protect against state exhaustion, monitor abnormal creation rates, and remove stale entries without breaking long-lived services.
ArchitectureAccount for asymmetric routing, clusters, failover, network address translation, and paths that bypass the stateful enforcement point; synchronize state where continuity requires it.
Important limitationConnection state is not user authentication or application safety. A permitted stateful flow can carry malicious content, and inaccurate, exhausted, or missing state can block legitimate traffic or admit traffic that policy did not intend.