 the corporate network. Packet filters are complex to maintain. They are also easy to penetrate. Circuit-level gateways operate at the session level (as does UDP). They are host-based, and as such, act as a relay program. They receive packets from one host and hand them off to another. This design is more secure than that of packet-filtering routers, but less secure than application-level gateways. Circuit-level gateways are not often used as standalone firewalls, but are combined with application gateways to deliver a full suite of features for a robust firewall system. Proxy-based firewalls have a detailed understanding of specific IP protocols and are extremely secure because they allow packet analysis at the application layer; packets claiming to be of one type but carrying another type of data will be rejected. They are very good for security because they do not actually allow an outside host to connect Standards for Conferencing over IP Networks to an inside host but, rather, relay information from one to the other. Unfortunately, a proxy firewall does not deal well with connectionless protocols such as UDP. Proxy servers can also add delay to connections if the computers on which they are running are slow or if the firewall code is not efficient (this increasingly becoming less of an issue). Dynamic filtering firewalls offer sophisticated, customizable, granular access-control schemes that allow network managers to determine who (and under what conditions) they will allow onto corporate networks. Firewalls in this category deal with packets at the applications-level. They are sometimes called stateful firewalls because they enhance packet-filtering with historical context to keep a history of all IP traffic that moves through the firewall. If a packet has gone from an intranet to someone on the Internet, it is generally assumed that it is acceptable to reverse the process, and thereby allow the host on the outside to return packets through the firewall. Application-level firewalls adapt best to UDP-support