Stateful Firewall: Connection Tracking & Spoofed-ACK Defense

Most firewall demos show a static rule list. This one shows the mechanism that actually protects modern networks: a live connection-tracking table walking real TCP sessions through their state machine — SYN_SENT, ESTABLISHED, FIN_WAIT, TIME_WAIT — in 3D, with packets crossing a firewall wall between an internal network and the open internet. Start a new outbound connection and watch the full handshake, data exchange and teardown get tracked entry-by-entry. Then fire a spoofed bare-ACK packet with no real session behind it and flip between stateful and stateless mode: a stateful firewall checks the packet against its real connection table and drops it instantly, while a naive stateless filter — which only checks whether the ACK flag is set — waves it straight through, the exact weakness Nmap's ACK scan exploits to map firewall rulesets from the outside.