In this lesson, you will learn how the Linux kernel keeps track of network conversations to make intelligent filtering decisions based on session history.
Understanding Stateful Inspection
Standard packet filtering is "stateless"—it looks at each packet in isolation, like a security guard checking every visitor’s ID without remembering who they already let in. Stateful Inspection changes this by maintaining a connection tracking table (conntrack). When the first packet of a session arrives, the kernel creates a record of that flow. Subsequent packets belonging to that same session are recognized immediately because they match an existing entry in the table.
The Lifecycle of a Session
The kernel tracks the state of a connection using several phases:
- NEW: The first packet seen (e.g., a TCP SYN).
- ESTABLISHED: Traffic flowing in both directions after a handshake is complete.
- RELATED: A secondary connection associated with an existing one, such as an ICMP error message or an FTP data channel.
- INVALID: Packets that don't belong to any known session or are malformed.
By maintaining this state, the kernel can automatically allow return traffic for connections you initiated, without you having to manually write firewall rules for every possible incoming response.
Inspecting the Conntrack Table
You can view the kernel’s internal state table in real-time using the conntrack utility. If you run:
conntrack -L
You will see output showing the protocol, state, and timers for active flows:
tcp 6 431999 ESTABLISHED src=192.168.1.5 dst=93.184.216.34 sport=443 dport=51234 [ASSURED] ...
In this example, the ESTABLISHED state informs the firewall that this traffic is part of an ongoing conversation. Because the kernel tracks this context, you can define a policy that allows all ESTABLISHED traffic, effectively "pinning" a hole in the firewall for legitimate replies while continuing to block unsolicited NEW connection attempts from the outside world. This drastically reduces administrative complexity and improves security by ensuring only expected packets pass through the kernel hooks.
Key Takeaway: Stateful inspection transforms firewall policy from static packet matching to context-aware flow management by utilizing the kernel’s connection tracking table to validate the legitimacy of incoming responses.