It seems that UDP traffic can't be screened for stateful inspection in my stateful-inspection firewall. Will a session in iptables produce the same results?

    Requires Free Membership to View

You're correct; UDP traffic can't be screened using strict stateful inspection. That's because UDP is a connectionless protocol and doesn't maintain session state. The protocol is much different than TCP, which uses a three-way handshake to set up and tear down connections.

However, most modern firewalls, including iptables, treat UDP in the same manner as a connection-oriented protocol. If you create a rule allowing UDP traffic in one direction, the firewall will allow associated return traffic.

Let's consider an example. Suppose you decided to allow outbound DNS traffic on UDP port 53. In its state table, the firewall will track any requests that match the rule, and the DNS server's UDP response is then allowed to reach the client.

Without a three-way handshake, however, the firewall doesn't know when to remove the entry from its state table. To accommodate this situation, firewalls usually use a timer that allows return traffic to pass until the connection is inactive for a specified period of time, which is normally a few minutes. Once the firewall reaches that inactivity threshold, it discards the entry from the state table.

More information:

  • Find out how extrusion detection and prevention products inspect network traffic and keep confidential information within the enterprise.
  • Learn how DNS amplification attackers use UDP packets to flood their victims.
  • This was first published in September 2007

    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: