Stateful Inspection (cont)

E.g.:
- Block a connection to port 25 if the first command given does not start with HELO or EHLO
- Open up an ftp data port if the packet filter sees a PORT command
- Doing this correctly is much harder than you'd think!

E.g.: