Stateful Inspection

• Inbound connections are above port 1023

• Solve this problem by creating a directory of outbound TCP connections, along with each session’s corresponding high-numbered client port

• State Table - used to validate any inbound traffic.