📘Cisco Certified CyberOps Associate (200-201 CBROPS)
1. Introduction
Firewalls are a key security technology in networking. They control and monitor network traffic to protect systems and data from unauthorized access or attacks. There are different ways firewalls inspect traffic, and each method has different capabilities and depth of inspection:
- Packet Filtering
- Stateful Inspection (Stateful Firewall)
- Deep Packet Inspection (DPI)
We will compare them in terms of how they work, what they can detect, and their use in IT environments.
2. Packet Filtering
Definition:
Packet filtering is the most basic firewall method. It looks at packets’ header information and decides whether to allow or block them.
What it checks in a packet header:
- Source IP address
- Destination IP address
- Source port
- Destination port
- Protocol (TCP, UDP, ICMP)
Key points:
- Only checks packet headers, not the data inside the packet.
- Cannot understand if the traffic is part of a legitimate session beyond the header.
- Fast and simple, but limited in security.
Example in IT environment:
- An organization blocks SSH traffic from external IPs by checking the destination port 22.
- Email server allows traffic only on port 25 (SMTP).
Pros:
- Very fast and low resource usage.
- Easy to configure simple rules.
Cons:
- Cannot detect complex attacks (like malware embedded in HTTP traffic).
- Cannot track if the packet is part of an established connection.
3. Stateful Firewall (Stateful Inspection)
Definition:
A stateful firewall goes a step further than packet filtering. It tracks the state of connections (TCP/UDP sessions) and ensures that incoming packets are part of an established session.
How it works:
- Maintains a state table that records ongoing sessions.
- Checks not only packet headers but also whether the packet is expected based on the session state.
Key points:
- Prevents unsolicited packets from entering the network.
- Can detect attempts to inject malicious traffic outside an existing session.
Example in IT environment:
- A client inside a network initiates a connection to a web server.
- The firewall allows the returning HTTP packets because it knows the session is established.
- If an attacker tries to send packets to the client without an active session, the firewall blocks them.
Pros:
- More secure than simple packet filtering.
- Can handle dynamic sessions like FTP or web browsing.
Cons:
- Still cannot inspect the content of the traffic.
- Cannot detect malware or malicious code embedded in the traffic.
4. Deep Packet Inspection (DPI)
Definition:
Deep Packet Inspection (DPI) is the most advanced firewall/inspection method. It looks inside the packet payload (data), not just the headers, to understand the content and detect threats.
How it works:
- Analyzes both header and payload.
- Can detect malicious patterns, viruses, spyware, or unauthorized applications.
- Can enforce application-level policies, like blocking peer-to-peer traffic or certain HTTP requests.
Key points:
- Works at Layer 7 (Application Layer) in addition to network and transport layers.
- Can detect complex attacks like SQL injection, malware in attachments, or malicious scripts.
Example in IT environment:
- A firewall blocks malicious HTTP requests containing malware in the request body.
- Blocks unauthorized use of Dropbox or Google Drive by inspecting the application data.
- Detects a worm trying to spread over the network even if it uses allowed ports like 80 (HTTP).
Pros:
- Very secure and granular control.
- Can enforce compliance and detect hidden threats.
Cons:
- Requires more processing power and resources.
- Can slow down network traffic if not properly scaled.
5. Comparison Table
| Feature | Packet Filtering | Stateful Firewall | Deep Packet Inspection (DPI) |
|---|---|---|---|
| Checks packet headers? | ✅ Yes | ✅ Yes | ✅ Yes |
| Tracks session state? | ❌ No | ✅ Yes | ✅ Yes |
| Inspects payload/data? | ❌ No | ❌ No | ✅ Yes |
| Security level | Low | Medium | High |
| Performance impact | Low | Medium | High |
| Example detection | Block port 22 | Block unsolicited packets | Block malware in HTTP traffic |
6. Key Takeaways for Exam
- Packet Filtering: Quick and simple; only checks headers; no session awareness.
- Stateful Firewall: Tracks sessions; blocks unexpected packets; still does not check content.
- Deep Packet Inspection: Checks headers, sessions, and content; can detect complex threats and enforce application policies.
Exam Tip:
- Be ready to choose the right firewall type based on scenario descriptions.
- Remember the difference in layers inspected: packet filtering (Layer 3/4), stateful (Layer 3/4 + sessions), DPI (Layer 3/4/7).
