Wrong. Passive FTP is the first example that comes to my mind where inspection (based on statefulness) is needed. Also, if you filter (and you should) both inbound and outbound traffic, how do you allow legitimate responses to the server? In many cases and network designs, statefulness also allows to build slightly shorter and more efficient filtering rules. This way, a step toward simplicity is often a step toward security.
On Wed, 11 May 2011 09:54:59 +0000, Dobbins, Roland wrote: > On May 11, 2011, at 4:52 PM, phocean wrote: > >> I want to read how you justify that stateful hardware is useless to >> check sessions of TCP and upper protocols. > > > In front of servers, where there is no state to inspect. > > > ----------------------------------------------------------------------- > Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> > > The basis of optimism is sheer terror. > > -- Oscar Wilde > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
