"Dominic" <d.foulkes-(E-Mail Removed)> wrote in
news:414b4389$0$52176$(E-Mail Removed) :
> Tiny Ramsden wrote:
> Stateful Packet Inspection
<snip>
> -A firewall FAQ
That definition sounds very like that of a consumer-grade NAT router,
and appears to add nothing.
My own view is that 'Stateful Packet Inspection' means exactly what
marketing people want it to mean
If anything, the 'State' that is referred to is the state of the TCP
connection, and that is defined in RFC 793. Pages 20-23 identify the
various states that a connection may be in. 'SPI' should check the
the flags in the packet to see if they match the state of the
connection. And that's it.
Of course, if you're in the market for redefining the terminology you
could expand the definition to include the ability to read and act
upon the contents of every packet. This then comes close to
application level inspection, and while it is possible for proxy
firewalls with significant engine power to do such filtering (for
viruses, email content etc) it is most unlikely that consumer grade
routers have this capability...
Does anyone have any real evidence of a successful attacks though a
properly configured NAT router? [excluding of course one that was
already compromised by malware already on the 'inside']
Hope this helps
--
Richard Perkin
To email me, change the AT in the address below
richard.perkinATmyrealbox.com
It's is not, it isn't ain't, and it's it's, not its, if you mean it
is. If you don't, it's its. Then too, it's hers. It isn't her's.
It isn't our's either. It's ours, and likewise yours and theirs.
-- Oxford University Press, Edpress News