Compare Firewall Operations
Packet Filtering, Stateful Inspection, Application Firewalls & IDS/IPS
Why Firewalls Matter
Firewalls are the gatekeepers of network traffic. They examine packets entering and leaving the network and make allow/deny decisions based on rules. Every organization has firewalls, and every SOC analyst reads firewall logs daily. Understanding HOW firewalls make decisions determines whether you can interpret their alerts correctly.
The Evolution of Firewalls
Firewalls evolved through generations, each adding deeper inspection capabilities:
| Generation | Technology | Inspects | Limitation |
|---|---|---|---|
| 1st Gen (1988) | Packet Filtering | IP addresses, ports, protocol | No session awareness — each packet evaluated independently |
| 2nd Gen (1994) | Stateful Inspection | Connection state + headers | Cannot inspect encrypted payload or application content |
| 3rd Gen (2000s) | Application Layer / Proxy | Full application payload (HTTP, FTP, DNS) | High performance cost, limited protocol support |
| NGFW (2010s) | Next-Gen Firewall | Everything + user identity + threat intel + SSL inspection | Expensive, complex to manage, SSL inspection has privacy concerns |
Firewall Types — Deep Comparison
Packet Filtering (Stateless)
How It Works
Examines each packet independently against an ACL (Access Control List). Checks source/destination IP, source/destination port, and protocol (TCP/UDP/ICMP). No knowledge of connection state.
ACL Rule Example
Stateless firewalls cannot distinguish between a legitimate response packet and an attacker-crafted packet with the ACK flag set. An attacker can bypass rules by sending packets that appear to be part of an existing connection.
Stateful Inspection
How It Works
Maintains a state table tracking every active connection (source IP:port, dest IP:port, protocol, state). Return traffic is automatically allowed if it matches an established session. No ACL entry needed for return traffic.
State Table Example
Application Layer (Proxy / WAF)
How It Works
Terminates the connection and creates a new one to the destination. Full visibility into application payload — can inspect HTTP headers, URLs, POST bodies, SQL queries. Acts as a man-in-the-middle (by design).
What It Can Block
SQL injection attempts in URLs, XSS payloads in form data, malicious file uploads, directory traversal attempts, unauthorized HTTP methods (PUT, DELETE). A packet filter cannot see any of this.
Next-Generation Firewall (NGFW)
Additional Capabilities
User identity awareness (ties rules to Active Directory users, not just IPs), application identification (recognizes Slack vs generic HTTPS), integrated threat intelligence (auto-blocks known malicious IPs), SSL/TLS inspection (decrypts, inspects, re-encrypts).
Common NGFW Vendors
Palo Alto Networks (PA series), Fortinet (FortiGate), Cisco (Firepower), Check Point, Juniper (SRX). Each has its own management interface and log format — SOC analysts must learn vendor-specific log parsing.
IDS vs IPS — Detection vs Prevention
| Feature | IDS (Intrusion Detection) | IPS (Intrusion Prevention) |
|---|---|---|
| Deployment | Passive — connected to SPAN/mirror port | Inline — sits in the traffic path |
| Action | Alert only — sends notification to SIEM | Alert + Block — drops malicious packets |
| Risk | May miss blocking threats (detection delay) | May block legitimate traffic (false positive = outage) |
| Performance | No impact on traffic flow | Adds latency (must process every packet) |
| Failure mode | Fail-open: if IDS fails, traffic flows normally | Configurable: fail-open (risky) or fail-closed (safe but causes outage) |
Detection Methods
Signature-Based
Matches traffic against a database of known attack patterns. Example Snort rule:
Strength: Very accurate for known attacks. Weakness: Cannot detect zero-days or novel attacks.
Anomaly-Based
Builds a baseline of "normal" traffic and flags deviations. Example: a workstation that normally transfers 50 MB/day suddenly sends 5 GB to an external IP.
Strength: Can detect zero-days and novel attacks. Weakness: Higher false positive rate, requires tuning period.
Policy-Based
Alerts when traffic violates defined policies. Example: "No FTP traffic allowed from DMZ to internal network" or "No DNS queries to external servers from database subnet."
Strength: Directly enforces organizational policy. Weakness: Requires comprehensive policy definition.
Common IDS/IPS Platforms
Snort
Open-source, signature-based, maintained by Cisco Talos. Industry standard for rule syntax. Output formats: Unified2, Syslog, CSV. 30,000+ community rules available.
Suricata
Open-source, multi-threaded (faster than Snort on modern hardware). Supports Snort rules + has its own enhanced rule language. Native JSON output (EVE log) — excellent for SIEM integration.
Zeek (formerly Bro)
Not signature-based — generates structured logs of all network activity. Produces conn.log, dns.log, http.log, files.log, etc. Best for forensic analysis and threat hunting rather than real-time blocking.
SOC Application — Reading Firewall Logs
What Firewall Logs Tell You
As a Tier 1 SOC analyst, you will see firewall alerts in your SIEM every shift. Here is how to read them:
Analyst Decision Matrix
| Log Indicator | Likely Meaning | Your Action |
|---|---|---|
| Repeated DENY to same external IP | Malware trying to reach C2 but blocked | Escalate — infected host needs remediation even though traffic is blocked |
| ALLOW to known-bad IP | Firewall rule gap — malicious traffic is flowing | Immediate escalation — create block rule, begin IR |
| High volume DNS queries to new domain | Possible DNS tunneling or DGA beaconing | Investigate source host, check domain reputation, correlate with EDR |
| Internal-to-internal DENY | Possible lateral movement attempt blocked by segmentation | Investigate source — why is a workstation trying to reach server subnet? |
| Outbound traffic on unusual port (4444, 8888) | Possible reverse shell or custom C2 channel | Immediate investigation — these ports have no legitimate business use |
A DENY log does not mean you are safe. If a host is generating blocked C2 traffic, the malware is already on the endpoint. The firewall stopped the communication but did not remove the infection. Always investigate the source host when you see repeated blocks to suspicious destinations.
Knowledge Check
1. What is the main advantage of a stateful firewall over a packet filter?
2. An IPS is deployed inline and configured to fail-closed. What happens if the IPS hardware fails?
3. You see repeated firewall DENY logs from an internal workstation to an external IP flagged as C2. What should you do?
4. Which detection method can identify zero-day attacks that have no known signature?
5. What is the key difference between Snort/Suricata and Zeek?