A stateful inspection module architecture

Packet filtering firewalls have evolved over the 1990s through a series of generations. Stateful inspection represents the climax of this evolution. This paper describes the security vulnerabilities and performance degradation inherent in the inspection module architecture of one of the leading firewalls in the market; Firewall-1 developed by Check Point. The paper proposes an architecture for a stateful inspection module that overcomes the security and performance problems. The proposed architecture protects against SYN flooding and firewall saturation denial of service attacks and preserves at the same time a high throughput