Re: stateful inspection

[Jose Nazario]

On Thu, 19 Apr 2001, JS Wong wrote:

> For the firewalls I've played with, at least, stateful inspection
> doesn't work for the UDP protocol because it's connectionless.

yes, UDP (and ICMP) are stateless. the firewall usually uses timing and
unique identifiers in the packet headers (ie DNS query id's, ICMP packet
headers, the like) to qualify packets. this is somewhat easily abused, but
... it works usually.

____________________________
jose nazario                                                 [EMAIL PROTECTED]
                     PGP: 89 B0 81 DA 5B FD 7E 00  99 C3 B2 CD 48 A0 07 80
                                       PGP key ID 0xFD37F4E5 (pgp.mit.edu)

-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]