Everybody looking to the next video.
So in this video we're gonna be talking about the opposite of the packet filtering or stateless inspection
firewalls.
We're gonna be talking about these state full inspection firewalls.
Now again this is the opposite of the packet filtering.
This will keep track of not just the source destination IP and ports but also what traffic is actually
being passed.
So if you have a connection where you're only a lot SSA traffic will report twenty two.
If somebody starts to throw HDP traffic or HDP s traffic or any other traffic other than S S H through
that through that port through that firewall it will block you can whether block it drop it whatever
you want to do this can also be tied into an intrusion detection system as well that allows it to inspect
the firewalls themselves.
Now I'm sorry the traffic in the packets and the whole connection as a whole.
Now this is commonly used for network based firewalls.
However there are instances where like the Windows Defender does have a state full inspection mode where
you can limit per port.
Again this is built on top of the stateless ones so you it has the stateless backbone and then they
add more on top of it.
Now what I want to have everybody understand is with firewalls they can be a bottleneck for network
traffic.
Now the most enterprise firewalls are pretty beefy.
They can handle the traffic.
However in most in some cases were smaller companies they might have every.
All their traffic running to one firewall and they're running it at 100 percent capacity.
And just a little bit of extra traffic or a little bit too much could take down the firewall and cause
the whole network to drop or an entire uplink to drop.
So keep that in mind when you're running scans that scans can be blocked just nature of the scan itself
but you can also take down a firewall or a switch or any other network device.
So keep that in mind when you're running any sort of scan.
There are options on the map to filter it back to where it's not hitting as hard.
You can also do a trick where you tell IP tables on your local Cowling machine or whatever you're using
to just drop traffic and then you can run an attempt at a scan or attempt at a particular request and
you can see how much data is actually being sent across.
So you want to keep under a certain threshold you can do it that way.
So this has been the first sets of videos the last video in this module we're gonna be going over the
Web Application Firewall.