Short answer
A stateful firewall records each connection in a state table and permits the return traffic of a flow it already approved, while a stateless packet filter judges every packet on its own headers. Use stateful inspection where user traffic terminates; keep stateless filtering for router and cloud access lists.
Key facts
- NIST defines stateful inspection as packet filtering that also tracks the state of connections and blocks packets that deviate from the expected state.
- A state table entry typically holds source IP address, destination IP address, port numbers and connection state information.
- NIST names three major states for TCP traffic: connection establishment, usage, and termination.
- Packet filters are also called stateless inspection firewalls and cannot associate multiple requests within a single session to each other.
- A packet filter decides on source address, destination address, protocol, session ports, and the interface and direction traversed.
- NIST notes that few firewalls sold today do only stateless packet filtering, though packet filtering remains at the core of most modern firewalls.
The two terms describe how much a filtering device remembers. A stateless packet filter looks at one packet, compares it against a ruleset, and forwards or drops it — then forgets it. A stateful firewall does the same inspection and additionally records the connection in a state table, so the packets that come back the other way are recognised as belonging to a flow it already approved.
NIST's firewall guidance is precise about this. Packet filters, it says, are also known as stateless inspection firewalls and do not keep track of the state of each flow of traffic passing through, which means they cannot associate multiple requests within a single session to each other. Stateful inspection is defined as packet filtering that also tracks the state of connections and blocks packets that deviate from the expected state, with entries in that table typically holding source address, destination address, port numbers and connection state.
In practice the distinction is not a product category any more. Packet filtering is at the core of most modern firewalls, and very few devices sold today do only stateless filtering — the stateless behaviour survives as a mode you deliberately select, most often in a router access control list or a cloud network access control list, where the point is cheap, order-independent filtering at line rate rather than session awareness.
At a glance
Side by side
| Factor | Stateful firewall | Stateless packet filter |
|---|---|---|
| Unit of decision | The connection | The individual packet |
| What it remembers | A state table entry per connection | Nothing between packets |
| Typical state table entry | Source address, destination address, port numbers, connection state | Not applicable |
| Return traffic | Permitted automatically when it matches an approved flow | Must be permitted by an explicit rule in the other direction |
| Rules to write | One rule per intended flow | One rule per direction, per flow |
| Protocol awareness | Tracks TCP connection establishment, use and termination | Reads header fields only |
| Fields inspected | Header fields plus connection state | Source and destination address, protocol, ports, interface and direction |
| Resource cost | Memory and CPU proportional to concurrent connections | Very low; no per-connection storage |
| Where it shows up | Perimeter and segmentation firewalls | Router access control lists, cloud network ACLs |
| Handling of connectionless traffic | Uses a timeout to age out sessions the protocol never closes | No sessions to age out |
Choose stateful inspection when
- The device is a perimeter, segmentation or branch firewall carrying real user traffic
- You want return traffic handled by the connection table rather than by a second rule you have to maintain
- Out-of-sequence and out-of-state packets should be dropped rather than matched on headers alone
- The policy has to be readable — one rule per intended flow, not two
Use a stateless filter when
- You are writing a router access control list or a cloud network access control list as a coarse outer layer
- The requirement is line-rate filtering on a small, static rule set
- The device has no room for per-connection state — a high-throughput core or transit point
- You want a blunt address or protocol block that sits in front of a stateful firewall, not instead of one
Bottom line
For anything that terminates user traffic, stateful is the default and has been for a long time: NIST's own guidance notes that few firewalls sold today do stateless packet filtering alone, and the reason is that a device which cannot associate the packets of a session cannot enforce a policy written in terms of sessions. Stateless filtering still earns its place as an outer layer — router access control lists and cloud network ACLs are cheap, order-independent and stateless by design, and they are a good place for coarse address and protocol blocks. Use them that way, in front of a stateful firewall rather than instead of one, and remember the operational consequence of state: every connection consumes a table entry, so connection-table capacity, not throughput, is often the number that decides which appliance a site actually needs.
Products for this decision
Small site, four 2.5G ports
Sophos
Sophos XGS 88 Network Security/Firewall Appliance
ZD88ZZ51ZZNGAA
A desktop or rack-mountable firewall appliance with four 2.5GBase-T ports and a rated firewall throughput of 9.67 Gbit/s, for a small office or branch.
Firewall throughput and threat-inspection throughput are different numbers; read both off the same datasheet.
$250.42Back-orderedCompact branch appliance
WatchGuard Technologies
WatchGuard Firebox T125 Appliance Only
WGT125000
A compact five-port firewall with 2.5 Gigabit and Gigabit Ethernet and a rated firewall throughput of 2.28 Gbit/s, sized for a branch or small headquarters.
$227.50In stockA step up in ports
WatchGuard Technologies
WatchGuard Firebox T145 Appliance Only
WGT145000
A five-port firewall appliance with centralised management and 2.5 Gigabit Ethernet, for a site that has outgrown its first compact appliance.
$345.62In stockRack-mount with intrusion prevention
Palo Alto Networks
Palo Alto PA-505 Network Security/Firewall Appliance
PAN-PA-505-SPR
A 1U seven-port firewall appliance with intrusion prevention and a rated firewall throughput of 1.20 Gbit/s, for a site that wants inspection in the rack.
$293.98Back-orderedFAQ
Common questions
- What is a stateful firewall?
- A firewall that records every connection it permits in a state table and checks each new packet against that table. Because it knows which flows are already established, it allows the return traffic of an approved connection automatically and drops packets whose state contradicts what it expects. NIST describes it as packet filtering that also tracks connection state.
- What is the difference between stateful and stateless?
- Whether the device remembers anything between packets. A stateful firewall keeps a connection table, so it can tell a reply from an unsolicited packet; a stateless filter evaluates each packet against its ruleset in isolation and, in NIST's words, cannot associate multiple requests within a single session to each other. That is why stateless rules have to be written in both directions.
- Can a firewall be stateful and stateless?
- Yes, and most are. Packet filtering sits at the core of modern firewalls, and stateful inspection is built on top of it, so one appliance commonly applies stateless header rules and stateful connection tracking in the same policy. Many designs also pair a stateless access control list on a router or cloud subnet with a stateful firewall behind it.
- Is Palo Alto stateless or stateful?
- Modern enterprise firewall platforms, including Palo Alto's, are stateful — they track connections in a state table and add application-layer inspection on top of that. NIST's guidance notes that very few firewalls sold today do stateless packet filtering alone; where you still meet genuinely stateless filtering is in router access control lists and cloud network ACLs.
- Does a stateful firewall slow down the network?
- Not meaningfully at the sizes it is specified for, but it does consume resources that a packet filter does not. Every tracked connection occupies a state table entry, so memory and CPU scale with concurrent connections rather than with raw bandwidth. When sizing an appliance, read the concurrent-connection and new-connections-per-second figures alongside the throughput number.
Sources