Question bank — Firewalls — stateless vs stateful packet filtering

True. It decides on this packet's header alone against the rule list; every packet is judged as if it were the first one ever seen.

False. The first packet of a new connection (the outbound SYN) has no table entry yet, so it must be judged by an explicit ALLOW/DENY rule before any state is created.

False. It blocks the initial SYN (ACK=0), but an attacker can hand-craft a lone packet with ACK=1 that matches no real connection — the stateless filter still lets it in (see TCP Flags (SYN ACK FIN RST)).

Mostly for spoofed-packet filtering, but not against every threat: its finite state table can be exhausted by a SYN flood, a DoS that a stateless box shrugs off.

True in practice. $(\text{srcIP},\text{dstIP},\text{srcPort},\text{dstPort},\text{protocol})$ pins down one flow direction; the firewall stores it plus the TCP phase so both directions map to one remembered conversation.

False. Its constant-time, memoryless simplicity makes it ideal for high-speed router Access Control Lists (ACLs) and it is immune to state-exhaustion DoS — it has a real niche.

False. Once ESTABLISHED, packets are matched to the table entry directly — a fast lookup — precisely to avoid re-running the whole ordered ruleset each time.

True. The final catch-all rule is DENY, so a packet that matches no ALLOW rule above it falls through and is dropped — safer than allow-by-default.

The error is "safe." Any port >1023 with ACK=1 is allowed, so a forged ACK to a high port slips through; the flag proves nothing about a real conversation existing.

The error: return traffic is rescued by the ACK trick (or by stateful memory). A SYN-ACK actually has ACK=1, so it matches the inbound-ACK ALLOW rule and gets through.

The error is "open no ports." Active FTP needs a second data connection on a dynamic port; an ALG helper reads the control channel and opens exactly that one port temporarily — it does open one, just precisely.

The error: tracking a sequence requires memory, which is exactly what stateless lacks. It sees three unrelated packets and judges each by header alone.

The error is conflation. Network Address Translation (NAT) rewrites addresses/ports and does keep a mapping table, but its purpose is address sharing, not policy enforcement — though both rely on remembered flows.

The error: ports are a Layer 4 (transport) field. IPs are Layer 3; see OSI Model — Layers 3 and 4 — a filter reading ports is inspecting L4.

The error: a permanent wide range is a standing hole an attacker can hit anytime, whereas the stateful ALG opens one port for one connection and closes it — far smaller attack surface.

Because there is nothing to acknowledge yet — the SYN opens the conversation, so no prior sequence number exists to confirm (see TCP Three-Way Handshake).

It stores nothing per connection, so there is no table to fill; each SYN is judged and forgotten, costing constant memory regardless of flood size.

The stateful box looks up the packet's 5-tuple, finds no matching approved connection, and drops it; the stateless box has no table to consult and trusts the ACK flag alone.

Because $\text{allow}(p)⟺p\in \text{StateTable}$ — the remembered connection is the rule, replacing fragile flag-based inbound rules with a direct membership check.

Once the connection closes, its 5-tuple should no longer be trusted; keeping the entry would let a late spoofed packet reuse a closed flow's "permission."

It reads only header fields and decides before the payload reaches any application, so bad traffic is dropped early without spending application-layer CPU.

It is treated as unsolicited — the entry is gone, so a stateful firewall re-evaluates it against explicit rules and (deny-by-default) drops it unless a rule allows it.

It creates a pseudo-state entry on the first outbound UDP packet (5-tuple) and allows return packets matching it for a short timeout, since UDP gives no explicit close.

The half-open entry sits in SYN_SENT until a timeout expires and is then removed; mass-producing such half-opens is exactly the SYN-flood exhaustion attack.

A stateful firewall drops it: a lone SYN-ACK with no prior outbound SYN belongs to no approved connection (this is a classic scan/spoof probe).

No — the 5-tuple includes distinct source IPs, so the tuples differ and each gets its own entry; that is why all five fields are needed.

A stateful firewall finds no matching request state and drops it as unsolicited; a naive stateless "allow all ICMP" rule would let it through, aiding reconnaissance.