Which filtering approach is most commonly associated with border firewall deployments today?

• A. Stateless packet filtering
• B. Stateful packet inspection
• C. Deep packet inspection
• D. Packet hashing

Answer: (B)

Stateful packet inspection is what border firewalls typically implement today. It tracks each active connection in a state table and makes decisions based on both the packet data and the context of the connection, allowing return traffic and applying policies within the session’s state. This approach handles protocols that involve multiple packets and dynamic port usage without needing static rules for every possible sequence, which is essential at the network edge where efficiency and correct handling of legitimate traffic matter. Stateless filtering looks at each packet in isolation and can stumble with multi-packet exchanges or dynamic port use. Deep packet inspection examines payloads and provides strong content awareness, but it’s more resource-intensive and not the default at the border in many deployments. Packet hashing isn’t a filtering method per se; it’s used for mapping traffic to resources or backends rather than making per-packet access decisions.