Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am researching in-line IPS devices and their signatures both stateful and stateless. The test network I am looking to implement the IPS in has asymmetric traffic so stateful inspection would be nearly impossible. What percentage of threats can only be mitigated from stateful inspection?

If I were to turn off stateful inspection on the IPS what threats am I leaving the test network open to?

share|improve this question
up vote 1 down vote accepted

Typically stateful packet inspection is the industry standard for network security to address malicious attacker behavior. Since you are running an asymmetrical network where packets can come in and go out on different network segments your IPS probably cannot maintain the state for all transactions, it is highly likely that attacks will not be identified and will be able to continue on their way to deliver their payload to their destination. So basically it will be more of a band-aid than a fix with tons of false hope.

Since stateful inspections not only examining header information they also inspection the entire packet content (up through the application layer) they determine more context about the packet beyond its source and destination information. Most, stateful inspection also monitors the state of a connection and compiles historic information in a state/session table. As a result, dynamic filtering decisions can be expanded beyond typical administrator defined rules that simply block known IP addresses or TCP ports (as in static packet filtering) to take into account the context of a packet that has been established by packets that previously passed through the IPS.

Without the stateful inspection turned on you are basically doing normal firewall blocking and leaving most of your traffic unmonitored. I am not sure of what type of time-line you are under but I would install an IDS box on your network, connect it to your main switch via a mirror port for a few weeks first to get an idea of how and who are your top suspected security threats and then plan a course of action.

We use Snorby or Security Onion on our network and it works very well for identifing potential threats. I even have it setup to email me nightly the previous days reports where it breaks out what local IPs have the most suspected traffic and what signatures they are hitting. Then we can backup and research if the signature hits are real or false positives. Then work to fix the issue.

I hope this helps

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.