A stateful firewall is a network-layer defensive control, one of the enforcement points a DDoS test drives traffic through to find where connection state runs out. Unlike a stateless ACL that judges each packet in isolation on its headers, a stateful firewall remembers connections. It tracks every flow through its lifecycle, records the state in a table, and uses that memory to allow return traffic and drop packets that do not belong to any connection it is watching.
How state tracking works
For every connection, the firewall stores an entry keyed on the 5-tuple: source and destination IP, source and destination port, and protocol. The entry records where the connection sits in its lifecycle (a new SYN, an established session, a half-closed teardown), and the firewall consults this table on every packet. A packet that matches an established entry passes without re-evaluation; a packet that matches nothing, an ACK for a session that was never opened or a spoofed out-of-state segment, is dropped.
That memory is what makes the firewall useful and what makes it fragile. State lives in a finite table, and each tracked connection consumes a slot. On Linux the table is conntrack; on commercial firewalls it is a session table with a hard vendor limit. The number is large but bounded, and a bounded resource is one an attacker can try to exhaust.
Stateless where it counts, stateful where it helps
The lesson most resilient architectures encode is that state should be committed as late and as cheaply as possible. A stateless filter at the edge can drop obviously malformed or spoofed traffic without ever allocating a table entry, because it decides per packet on headers alone. Only traffic that survives that cheap first pass should be allowed to consume a state slot deeper in the path.
Where a stateful device is unavoidable, its table is a tunable resource rather than a fixed one. On Linux, nf_conntrack_max sets the ceiling and the various timeout values decide how long a half-open or idle entry squats on a slot; shortening the SYN-received timeout frees slots faster under a flood, at the cost of dropping genuinely slow clients sooner. Those numbers are the difference between a firewall that absorbs a connection flood and one that becomes its first casualty, and they are exactly what a test exercises.
Why it becomes the layer of first failure
A SYN flood is not fundamentally an attack on bandwidth. It is an attack on this table. Each spoofed SYN opens a half-formed entry that sits consuming a slot until it times out. Enough of them and the table fills, and once it is full the firewall has no room to record a new connection, so it drops the next legitimate SYN alongside the attack.
The device meant to protect the origin becomes the layer of first failure, and it fails before the origin ever sees load. This is why a stateful firewall placed directly in an attack path is often the wrong tool for volumetric defense, and why upstream controls that validate a handshake before committing state, such as SYN cookies, exist at all. The firewall's state is precisely the thing a connection flood is trying to spend.
What a DDoS test measures
A test finds the number. It drives connections at a rising rate and measures the offered rate at which the state table saturates and new sessions start failing: the practical capacity of the device under a connection flood, rather than its datasheet throughput. Those two figures are rarely the same.
It also observes the failure mode. A firewall that fails closed drops everything when its table is full, taking the service down cleanly; one that fails open stops inspecting and passes everything, exposing the origin. Neither is a state you want to discover for the first time during a real incident.
The state table is the quiet ceiling in most architectures: invisible at rest, decisive under load, and impossible to size correctly from a spec sheet. Finding where it sits is the kind of measurement that has to happen against real infrastructure without taking it down, a discipline of its own. See DDoS testing without disrupting production.