What is the difference between stateful and stateless filtering?
狀態篩選和無狀態篩選有什麼差異？
Stateful filtering tracks the origin of a request and can automatically allow the reply to the request to be returned to the originating computer. For example, a stateful filter that allows inbound traffic to TCP port 80 on a webserver will allow the return traffic, usually on a high numbered port (e.g., destination TCP port 63, 912) to pass through the stateful filter between the client and the webserver. The filtering device maintains a state table that tracks the origin and destination port numbers and IP addresses. Only one rule is required on the filtering device: Allow traffic inbound to the web server on TCP port 80.
Stateless filtering, on the other hand, only examines the source or destination IP address and the destination port, ignoring whether the traffic is a new request or a reply to a request. In the above example, two rules would need to be implemented on the filtering device: one rule to allow traffic inbound to the web server on TCP port 80, and another rule to allow outbound traffic from the webserver (TCP port range 49, 152 through 65, 535).
狀態篩選會追蹤請求的來源，且可自動允許將請求的回覆傳回來源電腦。例如，允許 Web 伺服器上 TCP 連接埠 80 傳入流量的狀態篩選將允許傳回流量，通常是編號較高的連接埠 (例如，目的地 TCP 連接埠 63、912) 透過用戶端與 Web 伺服器之間的狀態篩選傳送。篩選裝置會維護一個狀態表，用於追蹤來源和目的地連接埠號碼與 IP 地址。篩選裝置上只需要一個規則：允許流量傳入 Web 伺服器的 TCP 連接埠 80。
另一方面，無狀態篩選只會檢查來源或目的地 IP 地址和目的地連接埠，而忽略流量是新請求還是對請求的回覆。在上述範例中，篩選裝置上需要實作兩個規則：一個規則允許流量傳入 Web 伺服器的 TCP 連接埠 80，另一個規則允許來自 Web 伺服器的傳出流量 (TCP 連接埠範圍 49, 152 到 65, 535)。