stateful inspection
termsecuritynetworking
Filtering that remembers connections, so a packet is judged by whether it belongs to a flow the policy already allowed.
Keeping state is what lets a firewall permit replies without permitting everything that resembles one, and it is why a modern rule set is written in terms of who may initiate rather than which packets may pass. The cost is a table with finite size and entries with timeouts, which turns into two operational facts: a connection idle longer than the timeout is silently dropped and the application sees a hang rather than a refusal, and the table itself is a resource an attacker can exhaust. Most mysterious long-lived session failures are one of those two.
Also known as: connection tracking, conntrack