Using State Information: TCP

• Keep Track of outbound TCP packets:

  • If match on existing “session”, update session data
  • If session setup packet (SYN, no ACK), create new session in state table
    • keep until session ended
  • If session shutdown packet
    • delete session from state table