Re: Stateful Inspection

From: Erik (
Date: 05/17/02

From: Erik <>
Date: 16 May 2002 22:59:47 GMT

Wolfgang Kueter <> wrote:
[snip stateful packetfilters are fast]

> Simply wrong, stateful packet filters are slower than non stateful
> ones, because the rules change dynamically.

?? Elaborate. Look at IPF, then see that packets, which are already in
the state table are checked for a.o. ip addresses and sequence numbers.

Non stateful packetfilters will have to check _every_ packet
_completely_ against the _complete_ ruleset. Do you want to make a bet
which is faster?

> Therefore they consume more
> memory and CPU time than non stateful packet filters.

That seems to depend on the implementation of the states. At least in
IPF and pf but most probably also in iptables this is absolutely not
true. I doubt that the commercially available packages are that

Did you run benchmarks?


For OpenBSD pf en nat rule examples: