Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
What is Stateful Inspection?
Stateful inspection is a technique used to restrict the traffic flow between networks. It will observe the live connections in the network and based on it, it allows and restricts the packet’s access based on the security policies. It most key element in tracing is the state of network sessions. Accessibility depends on the session state. ‘Dynamic Packeting Filtering’ is the other name. And this technology is related to a firewall so it restricts accessibility through the firewall.
The state specifies the process status and the context is the content or data of the packet including the IP address and related data. Here it checks the packet’s state and context based on it taking decisions for accessibility. For example, if a packet arrives in a network, it checks the packet state and context, if it identifies any unsafe data or threats then it blocks those packets.
Working functionality of Stateful inspection
In stateful inspection, detects every packet that is coming into and going out of the network. When any incoming request came the firewall will check the connection if it assures safe then accepts the connection for transferring the packets between the networks. It doesn’t allow the connection if it identifies any threat while examining. It also checks the data in the packets if it is safe it allows otherwise discards the packets.
This stateful inspection also includes a technique called encryption to identify the threats, which may increase the performance and also make safer connections. Packet filtering is performed for legitimacy. It compares the current packet data with the previous packet data by examining only if it allows packets into the network.
Consider a Transmission Control Protocol used to send and receive the data. Before sending the packet initially the connection should be established, for this, they follow a 3-way handshaking mechanism which includes three stages SYN, SYN-ACK, and ACK. Then the packets through that links will be examined i.e state and context. If there is an identical entry then it allows through the firewall otherwise the packets undergo policy checkers. If the packet satisfies the policy requirements that it understands that it is a replacement connection that already exits and stores the data and allows the packet through the firewall. The packet is got discarded if it is not matched the policy checker’s requirements.
Difference between stateful and stateless inspection
Stateless Inspection used previously, and it has a set of predefined rules. These rules help to prevent cybercriminals. If the packets satisfy those rules and they will be treated as safe and can enter the network. It doesn’t perform any inspection. It is not strong compared to stateful inspection.
In stateful inspection, inspection is done on every packet’s data and context that will reduce the traffic in the network by discarding the unsafe packets. Threats created by harmful packets will not enter the network so it was more powerful than the stateless inspection.
Advantages
The state can be known with the stateful inspection of the connection.
It doesn’t include a huge range of ports to provide communication.
This will help to prevent Denial of Service attacks.
It is a more robust technique.
It will easily identify the packets with illegal data that are trying to enter the network.
While examining the packets it will store the packet information for log purposes.
It doesn’t require many ports for smooth communication.
Reduces the traffic overflow in the network by restricting the packets.
Disadvantages
The configuration of stateful inspection is very hard and complex.
It might prevent different attacks except for application layer attacks.
It doesn’t perform user authentication before the confirmation of connection.
Not supports all ports.
The different application uses different ports for the auxiliary connection they use dynamic port number.
Maintaining of state table will be an additional task to the stateful inspection.
Conclusion
Stateful inspection techniques are helpful in the network for safer communication and data transmission. Unlike stateless, stateful will strongly check the packets instead of just obeying rules it further examines the packets. It not simply checks the packet and also performs comparisons with its legitimate or privileged data and stores the data in the data table. Maintaining the state table is another task for this. Illegal accessibility is not possible with this strong technique. Provides session-level protection by maintaining the state info for every session and take decisions based on the state table. It easily identifies the replaceable connections and stores information that will be used for further monitoring.
104 Views
