State Caching (cont)

For ICMP, source and destination address is kept in the state table as well as the ICMP type
Only ICMP queries can enter the state table
Response is only allowed if:
- addresses match, and
- it is a valid one to that type (e.g. timestamp reply to a timestamp query), and
- the icmp_id and icmp_seq fields match

For ICMP, source and destination address is kept in the state table as well as the ICMP type