- [Instructor] Another way to classify firewalls
is by how they examine packets.
There are generally two ways firewalls examine packets.
One is static packet filtering, or SPF,
which inspect packets one at a time.
This approach doesn't use any memory.
The second way is referred to
as stateful packet inspection, or SPI,
which inspects packets in relation to previous packets.
This approach uses memory that remembers
the details about each packet
and because of the use of the memory,
it has substantial advantages.
What does a static packet filtering firewall examine?
It looks at source IP, destination IP,
source port number, and destination port number.
What is then the advantage of stateful packet inspection
over static packet filtering?
The main advantage is since it has memory,
it doesn't need to inspect all the details of packets
every time it sees a packet.
For example, let's say that an incoming or ingress packet
is sent as a response to an egress or outgoing packet.
Since the stateful packet inspection firewall knows
it's a response to an outgoing packet,
it doesn't inspect all the packet details.
It simply accepts it.
However, in the case of static packet filtering firewalls,
because they don't have any memory,
they treat the packet as if they never saw it.
Despite this disadvantage,
static packet filtering firewalls have their own advantage
over stateful packet inspection firewalls.
One of the advantages is their simplicity,
which makes them easy to configure and maintain,
and because they're simple,
they also require less computing resources
when they're running.
Most of the modern firewalls are
stateful packet inspection firewalls.