Stateful Packet Inspection (SPI) examines traffic at layers and while maintaining connection state. The firewall tracks:
- Source and destination IPs
- Source and destination ports
- TCP sequence numbers
- Connection state (new, established, related)
When a TCP handshake starts, SPI notes it as NEW. After completion, it becomes ESTABLISHED. The firewall uses this information to make intelligent filtering decisions. Packets claiming to be part of a connection that doesn't exist are dropped.