Stateful multilayer inspection firewalls combine the aspects of the three types of firewalls (Packet Filtering Firewall, Circuit-Level Gateway Firewall, and Application-Level Firewall).

• They filter packets at the Network Layer of the OSI model (or the internet layer of the TCP/IP model) to determine whether session packets are legitimate, and they evaluate the contents of the packets at the application layer.
• Using stateful packet filtering, you can overcome the limitation of packet firewalls, which can only filter the IP address, port, protocol, and so on.
• This multilayer firewall can perform Deep Packet Inspection.

Features of Stateful Multilayer Inspection Firewalls:

• This type of firewall can remember the packets that passed through it earlier and make decisions about future packets accordingly.
• These firewalls combine the best features of both packet filtering and application-based filtering.
• ==Cisco PIX firewalls are stateful==.
• These firewalls track and log slots or translations.

A stateful firewall, often categorized as a Stateful Multilayer Inspection Firewall, is a sophisticated network security solution used to protect networks by tracking active network connections and evaluating packet context across multiple layers of the OSI model.

Core Mechanism and Definition

A stateful multilayer inspection firewall combines features from other firewall types, including packet filtering, circuit-level gateways, and application-level firewalls.

1. State Tracking: This type of firewall can remember the packets that passed through it earlier and uses this memory to make decisions about subsequent packets. This feature of maintaining session context is referred to as stateful packet filtering.
2. Layered Inspection: It filters packets at the network layer of the OSI model (or the internet layer of the TCP/IP model) to determine whether session packets are legitimate. Additionally, it evaluates the contents of the packets at the application layer.
3. Functionality: Stateful firewalls track and log slots or translations. By utilizing stateful inspection, they overcome the limitations of simple packet firewalls, which can only filter based on source/destination IP address, port, and protocol. They incorporate the best features of both packet filtering and application-based filtering.
4. Traffic Control: This filtering process allows traffic based on a wide range of rules specified at the application, session, and packet filtering levels.

An example of a stateful firewall mentioned in the sources is the Cisco PIX firewall.

Interaction with Attack Techniques (Scanning and Evasion)

The stateful nature of these firewalls is a key factor in how they respond to network reconnaissance attempts, particularly ACK scans.

1. Distinguishing Stateful from Packet Filtering

Attackers and security professionals can use the ACK scan technique to probe for the existence of a firewall and its rule sets.

• Simple Packet Filtering: Simple packet filtering (which is stateless) will generally allow established connections (packets with the ACK bit set).
• Stateful Filtering: A more sophisticated stateful firewall does not allow the establishment of a connection unless it is part of a tracked, legitimate session. When an attacker sends a TCP ACK segment out-of-sync or to a closed port, the stateful firewall will generally discard the packet, resulting in no response being sent back.

2. Detecting Stateful Firewalls using ACK Probes

If an attacker performs an ACK flag probe scanning technique, the presence of a stateful firewall can be inferred based on the response received:

• If the attacker sends an ACK probe packet with a random sequence number and receives no response from the target, this indicates that the port is filtered, and a stateful firewall is present.
• If the ACK probe receives an RST (Reset) response, the port is considered unfiltered, meaning no stateful firewall is present.

3. Vulnerability to DoS Attacks

Stateful firewalls can be a target for Denial-of-Service (DoS) attacks. Protocol DDoS attacks can consume the connection state tables present in network infrastructure devices, such as firewalls and load balancers. If these tables are exhausted, the device will wait for existing connections to close or expire, thus allowing no new connections.

A stateful firewall acts like a security guard who not only checks every ID (packet header) but also keeps a detailed visitor log (tracking the session state). If an established guest (an ACK packet) arrives, it's allowed in immediately because the guard remembers the previous entry (the SYN). However, if a suspicious person tries to cut the line and skip the initial handshake (an unsolicited ACK packet), the stateful firewall discards the request entirely, unlike a simpler guard (packet filter) who might recognize the ID format and let it pass through.

Scanning

The scanning technique specifically used to determine whether a firewall is stateful or stateless and to map out its rule sets is the ACK Flag Probe Scan (also known as a TCP ACK Scan).

How the ACK Scan Detects Stateful Firewalls

The ACK Flag Probe Scan (using the -sA option in Nmap) exploits the fundamental behavior difference between basic (stateless) packet filters and sophisticated (stateful) firewalls:

1. Purpose: This scan does not determine if a port is open or closed, but rather whether the port is filtered or unfiltered. This is critical for assessing firewall configurations.
2. Stateful Firewall Response: A stateful firewall tracks active network connections and recognizes if an incoming packet belongs to an established session. If an attacker sends an ACK probe packet (with the ACK bit set) without a preceding legitimate session (an "out-of-sync" packet):
   • The stateful firewall will generally discard the packet.
   • The expected result back to the attacker is no response from the target.
   • Receiving no response indicates that the port is filtered and implies that a stateful firewall is present.
3. Stateless Firewall Contrast: In contrast, a simple packet filtering firewall (which is stateless) might allow packets with the ACK bit set, especially if it only filters based on basic criteria like IP and port, not session state. If a port is unfiltered (meaning no firewall is strictly controlling the session state), the target system, following RFC 793 (TCP), is expected to respond to the unsolicited ACK packet with an RST (Reset) packet.

The goal of the ACK scan is to probe the existence of a firewall and its rule sets. The lack of a response when sending an ACK probe is the characteristic indicator that a stateful filtering mechanism is intercepting and dropping the traffic.

In host discovery techniques, a TCP ACK Ping Scan (-sn -PA in Nmap) involves sending an empty TCP ACK packet; if the host is active but there is no prior connection, the target system will typically respond with an RST flag to terminate the request, thereby indicating the host is active. However, when used specifically against firewalls to test their filtering capability, the "no response" scenario described above identifies the presence of the stateful filter.