A firewall state table dynamically stores information about active connections allowed by firewall rules.
Each entry in the table defines a connection based on:
Protocol — The predefined way one service talks with another; includes TCP, UDP, and ICMP protocols.
IP addresses for local and remote computers — Each computer is assigned a unique IP address. IPv4, the current standard for IP addresses, permits addresses 32 bits long.
Port numbers for local and remote computers — A computer sends and receives services using numbered ports. For example, HTTP service typically is available on port 80, and FTP services on port 21. Port numbers range from 0–65535.
Process ID (PID) — A unique identifier for the process associated with a connection’s traffic.
Timestamp — The time of the last incoming or outgoing packet associated with the connection.
Timeout — The time limit (in seconds) after which the entry is removed from the table if no packet matching the connection is received. The timeout for TCP connections is enforced only when the connection isn't established.
Direction — The direction (incoming or outgoing) of the traffic that triggered the entry. After a connection is established, bidirectional traffic is allowed even with unidirectional rules, provided the entry matches the connection’s parameters in the state table.